diff --git a/doc/REST-API.txt b/doc/REST-API.txt
index f7135493..3d6cac85 100644
--- a/doc/REST-API.txt
+++ b/doc/REST-API.txt
@@ -6,6 +6,11 @@
 The server provides a REST api end point to provide functionality outside the
 the channeling API or without a established web socket connection.
 
+The REST API does always return valid JSON data. This includes the non 200
+status responses. If non JSON is received this is an error not generated by the
+API or there was a problem while JSON encoding.
+
+
 Available end points with request methods and content-type:
 
 
@@ -34,12 +39,7 @@ Available end points with request methods and content-type:
           "success": true,
           "token": "validated-auth-token"
         }
-      Response 200:
-        {
-          "success": false,
-          "token": ""
-        }
-      Response 413:
+      Response 403, 413:
         {
           "success": false,
           "code": "error-code",
diff --git a/src/app/spreed-speakfreely-server/sessions.go b/src/app/spreed-speakfreely-server/sessions.go
index b89e3a55..6baf557e 100644
--- a/src/app/spreed-speakfreely-server/sessions.go
+++ b/src/app/spreed-speakfreely-server/sessions.go
@@ -87,7 +87,7 @@ func (sessions *Sessions) Patch(request *http.Request) (int, interface{}, http.H
 	}
 
 	if error {
-		return 403, NewApiError("session_patch_failed", "Failed to patch session"), nil
+		return 403, NewApiError("session_patch_failed", "Failed to patch session"), http.Header{"Content-Type": {"application/json"}}
 	}
 
 	return 200, &SessionNonce{Nonce: nonce, Success: true}, http.Header{"Content-Type": {"application/json"}}
diff --git a/src/app/spreed-speakfreely-server/tokens.go b/src/app/spreed-speakfreely-server/tokens.go
index 78550446..70c0d406 100644
--- a/src/app/spreed-speakfreely-server/tokens.go
+++ b/src/app/spreed-speakfreely-server/tokens.go
@@ -41,19 +41,17 @@ func (tokens Tokens) Post(request *http.Request) (int, interface{}, http.Header)
 	auth := request.Form.Get("a")
 
 	if len(auth) > 100 {
-		return 413, NewApiError("auth_too_large", "Auth too large"), nil
+		return 413, NewApiError("auth_too_large", "Auth too large"), http.Header{"Content-Type": {"application/json"}}
 	}
 
 	valid := tokens.provider(strings.ToLower(auth))
-	response := &Token{Token: valid}
 
 	if valid != "" {
 		log.Printf("Good incoming token request: %s\n", auth)
-		response.Success = true
+		return 200, &Token{Token: valid, Success: true}, http.Header{"Content-Type": {"application/json"}}
 	} else {
 		log.Printf("Wrong incoming token request: %s\n", auth)
+		return 403, NewApiError("invalid_token", "Invalid token"), http.Header{"Content-Type": {"application/json"}}
 	}
 
-	return 200, response, http.Header{"Content-Type": {"application/json"}}
-
 }
diff --git a/static/js/services/mediastream.js b/static/js/services/mediastream.js
index 1a478de6..d022570c 100644
--- a/static/js/services/mediastream.js
+++ b/static/js/services/mediastream.js
@@ -98,7 +98,7 @@ define([
                     return
                 }
 
-                api.requestAuthentication(lastUserid, lastNonce);                
+                api.requestAuthentication(lastUserid, lastNonce);
 
             };
 
@@ -252,10 +252,16 @@ define([
                                     });
                                 }
                             }).
-                            error(function() {
-                                alertify.dialog.error(translation._("Error"), translation._("Failed to verify access code. Check your Internet connection and try again."), function() {
-                                    prompt();
-                                });
+                            error(function(data, status) {
+                                if ((status == 403 || status == 413) && data.success == false) {
+                                    alertify.dialog.error(translation._("Access denied"), translation._("Please provide a valid access code."), function() {
+                                        prompt();
+                                    });
+                                } else {
+                                    alertify.dialog.error(translation._("Error"), translation._("Failed to verify access code. Check your Internet connection and try again."), function() {
+                                        prompt();
+                                    });
+                                }
                             });
                         };
                         if (storedCode) {