clear credentials on 401 response