minor initialisation bug, should not really affect anything
need to revert this one line to keep sources count in sync
don't drop authenticated flag if 2xx response already given

this should deal with failed fallback cases not triggering listener_remove