intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
    let url = request.url;

    // build out full url if necessary
    if (url.startsWith('/')) url = `${this.baseUrl}${url}`;

    // pass through if not an api request
    if (!url.startsWith(this.baseUrl + '/api')) return next.handle(request.clone({url}));

    this.auth = this.auth || this.injector.get(AuthService);

    return this.auth.oidcUser$.take(1)
      .mergeMap((user) => next.handle(
        request.clone({url, setHeaders: {'Content-Type': `application/json`, Authorization: `Bearer ${user.access_token}`}})))
      .catch((err: HttpErrorResponse) => {
        // rerequest after 401 error
        switch (err.status) {
          case 401:
            console.log('Received unauthorized response for ' + request.url + ' with query params ' + JSON.stringify(request.params));
            // logout if endpoint is misbehaving
            console.log(this.retryAttempts[err.url], ' attempts made');
            if (typeof this.retryAttempts[err.url] === 'undefined') this.retryAttempts[err.url] = 0;
            if (this.retryAttempts[err.url]++ > 5) {
              console.log('start signout');
              this.auth.startSignoutMainWindow();
              return Observable.never();
            }

            // retry
            console.log('retrying');
            return Observable.fromPromise(this.auth.update()).mergeMap(() => this.intercept(request.clone(), next));
        }

        return Observable.throw(err);
      });
  }