Refactor callback hell

That should be status code 401 to demonstrate that the user is unauthorised with confirmation token.