- correctly trigger done_cb to avoid stuck requests
- pass up an UNAUTHENTICATED status so that clients know what happened