To make things even weirder, we discovered that new users that we create recieve a 401 when logging in.
also, for users that have a working login, when we change the PW in the AD, the webgui login works with the new password - but the editor login doesnt.