Handle authenticated but not authorized users