still can't detect 401's, which should redirect to login form