I notice that curl doesn't include the Authorization header on the first request, but I am out of my depth here.
That could be an interesting hint. In the latest snapshot [1], I have removed the Authorization header from the first request. Can you check if it makes a difference?
If not, could you share the headers of the second requests with us?