Don't delete session on 401 error

[zzooeeyy]

Addresses this concern: #1795 (comment)

What this PR does

Not deleting the session when 401 error has occurred in token exchange retry.

Checklist

Before submitting the PR, please consider if any of the following are needed:

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.

[paulomarg]

Is this behaviour present in remix too? Might be something we want to change there too, as folks make a good point about being overzealous in cleaning up data.