added an optimization to the oauth client awhile back where it'd only let one request go through and defer the rest if dpop nonce had probably expired
...i was comparing the time with when the persisted value expires from storage, instead of when it was persisted... the optimization never ran