Throw 401 for /auth requests that aren't authenticated