Invalidate credentials on 401 or 403