default http code 401 on auth failure