handle unauthorized status, no automatic open, http auth tokens