After login, a request sent with an Authorization header gets a 302 from the server to a different host, and then a 401 comes back. Why did that 401 happen?