even if the profile fails (expired token), we may still want the auth (to refresh the token)