return 204 for bad auth