changes to return 401 response when auth fails