we never want to leave a hanging promise. we want to reject the promise even if reauthentication fails, and we've already called the on-can't-reauthentication callback.