fix(oauth): keep the challenged request's login on its own clock

An unauthenticated request holds context.lock until that 401 login finishes, so a peer waits on the lock instead of starting a second login. A request that already has a token still yields outside the lock.

Author: Bartok9