shouldn't the response be a 401/403?