- add a 401 error handler so we don't get CORS errors on auth failure