use http.Error instead of log.Panic