* changing response from missing client token to permission denied * removing todo comment * fix tests * adding changelog * fixing changelog