working on session management updates
http-auth to handle failed (401) requests due to an invalid token that is on the client but may not be authorized any more (e.g., expired)