fix auth header and error message