return correct 401 status code for unauthorized calls