hmm. So what's really strange is that createNewSession should never result in 401. It can result in 500 error (which is = to a general error) though. So it makes me wonder if you have overriden the default general error handler to return 401 response code