since a 401 error triggers an auto-login on the client, it should only be sent if there is no session. There might be a better error code to use for asking clients to revalidate?