only use 307 redirects for auth calls, other redirects should still be 302s so hitting refresh later doesn't resend POST request
handle errors returned from auth service