First it tries to send a /refresh requests with no cookies (as I'm logged out) which returns 401 - which is fine