validate raise 400 Bad Request and add 401 Unauthorized