 authentication server works to be able to implement this correctly.
For example, if your authentication server returns a 401 when an OAuth2 error occurs, and your downstream
service also returns a 401 when you are not authorized to perform that operation, how do you know which layer
of the backend returned you a 401? You do not want to trigger a refresh unless you know your authentication
server is actually the layer rejecting the request. Again, work with your authentication server team to understand
how 