http: on error response throw away security context