stop infinite loop in opening authenticated url.  (ctl.redirectlimit makes
it appear that we're not looping because clientbody open tries to
return an incomplete result if possible.)