change code to HTTP_UNAUTHORIZED
html compliance cleanup