correct headers on not_found/not_authorized