hey, i'm facing a weird issue with the account_states endpoint

sending a request with the api key returns 401, Authentication failed: You do not have permissions to access the service. the api key and session id are both correct. sending a request with the access token returns a success code, but when using "guest_session_id" in params, it doesn't return the states of the guest session. instead, it returns the states of my user account (the account whose access token is being used).

example:

curl --request GET --url "https://api.themoviedb.org/3/movie/533535/account_states?guest_session_id=xxx&api_key=xxx" --header "accept: application/json"

returns:

{
    "success": false,
    "status_code": 3,
    "status_message": "Authentication failed: You do not have permissions to access the service."
}

and

curl --request GET --url "https://api.themoviedb.org/3/movie/533535/account_states?guest_session_id=xxx" --header "Authorization: Bearer xxx" --header "accept: application/json"

returns:

{
  "id": 533535,
  "favorite": false,
  "rated": false,
  "watchlist": true
}

which are the states for my own account, not the guest session.