Note bug.

I noticed that request after refreshing access token fails because the new access token isn't available without a round-trip to set the cookies.