accept HTTP 403 as well as 401 to mean 'unauthorized'
Merge remote-tracking branch 'upstream/master'