Make api only return json for authorization errors