Use 401 error when unauthorized