add a bit more logging and retry request if forbidden (auth fail)