changed wrong auth to bad request