send unauthorized user to 404 page