handling authorization error properly