better error handling on unauthorized