Don't set a 401 on non-api redirects so browsers will automatically follow them