changed unauthorized response content-type to be application/json