fix(auth): detect 401 responses and force login