PASS: AuthFlow (me válido, 401 sem auth, 403 mismatch, refresh OK).