Reauth should probably be optional. For example, we don't want to reauth when receiving 401 during create server (currently).