Godot WebSocketClient and HTTPRequest: enforcing least-privilege tokens and detecting expired credentials

Goal

I am designing the network layer for a Godot 4 project that talks to a backend over WebSocketClient and HTTPRequest, plus some high-level multiplayer RPC. I want to follow least-privilege principles: short-lived bearer tokens with narrow scopes, and a clean way to react when a token expires mid-session.

Constraints and uncertainty

From the documentation, both WebSocketClient and HTTPRequest let me set arbitrary request headers such as Authorization: Bearer <token>, but I cannot find any built-in mechanism that detects a 401/403 response, signals token expiration, or retries with refreshed credentials. It appears the developer must inspect response codes manually and update headers in script. Similarly, the high-level multiplayer API seems to gate RPC calls only on the network authority flag, with no method-level permission scoping, so any authorization beyond that would need custom checks inside each RPC method.

My concern is doing this without introducing an infinite reconnect loop when refresh fails, and without leaking tokens into logs or remote peers. I also want to avoid a design where a compromised non-authority peer can invoke privileged RPC methods because I relied on the authority flag alone.

Questions

• Is there any engine-level signal or callback for credential expiration on WebSocketClient or HTTPRequest, or is polling response codes the only documented option?
• For least-privilege RPC, what is the recommended pattern for restricting which methods a specific peer may call beyond the built-in authority check?
• When a token expires on an open WebSocket connection, should the client close and re-handshake with a refreshed token, or is re-sending headers on the same connection supported?