return HTTP_NOT_FOUND instead of HTTP_UNAUTHORIZED
resolve conflicts