Not all 401s are OTP needed