i changed the default portal to just require view and personalize permission and it works fine.
i then created a new portal and set it up for view and personalize permission, but i get a 401 error when trying to access it. it will only grant access if i setup this portal up for viewrecursive permissions.
any ideas why these 2 portals are behaving differently?