gave up on redirect, just send 401