it rejects with authentication failure if the authRequest also generates a 401