i think we discussed about this before, but can't find it anymore. why only run the invalidators on a successful response? maybe we could just skip them if its a 403 forbidden response to prevent attacks, but run in all other cases, wdyt?