user does not have valid auth - no token