If the 1st call fails, then we try a second call.
If this 2nd call fails too, the raised error will concern the 2nd call, not the 1st one.
I think that, if both call fail, the raised error should concern the 1st call, because it's the expected one.
If the error is a 403 (not a 401), raising the 2nd call's error will hide this informations.

Besides, this solution is a logout. So if the use _have to_ be logged in, he will receive a 401 error whatever the real problem (the one raised at line 80) was.

I think a better way would be to catch 401 (and maybe 403?) errors in the controller and try to log in the user.
If the user is already logged in (and if he is redirected to the right page), the oauth2's double redirection should be transparent. This solution would allow to refresh the access_token—instead of deleting it.

What do you think about this approach?