return 401 response code if no session