don't boot user out on 401, log it so we know