bail if upstream response is bad

TODO: report the appropriate error, possibly re-auth