In at least some cases we're generating invalid JSON, which is throwing an error on the client side when they receive it.

In my case, it was 'Not authorized.' -- which shouldn't happen when you're visiting from the app! How did we lose the session?

So we need to do a few things:

1) Not-authorized should be returned as JSON so the client can process and act on it.

2) If the client receives the 'Not-authorized' error, we should reload the page to reestablish the PHP session.

3) We should log all authorization errors (with API key and/or session ID).

4) We should test all JSON to see if it's valid before we spit it out to the client. If not, we should log it and give a nicer error message.

Done.

Closing (all resolved and published)