diff --git a/www/common/outer/async-store.js b/www/common/outer/async-store.js
index ec3fd7653..e87f2cc97 100644
--- a/www/common/outer/async-store.js
+++ b/www/common/outer/async-store.js
@@ -1529,6 +1529,34 @@ define([
                     channel.bcast("PAD_ERROR", err);
                     Store.leavePad(null, data, function () {});
                 },
+                onRejected: function (allowed, _cb) {
+                    var cb = Util.once(Util.mkAsync(_cb));
+
+                    // There is an allow list: check if we can authenticate
+                    if (!Array.isArray(allowed)) { return void cb('EINVAL'); }
+                    if (!store.loggedIn || !store.proxy.edPublic) { return void cb('EFORBIDDEN'); }
+                    var rpc;
+                    var teamModule = store.modules['team'];
+                    var teams = (teamModule && teamModule.getTeams()) || [];
+
+                    if (allowed.indexOf(store.proxy.edPublic) !== -1) {
+                        // We are allowed: use our own rpc
+                        rpc = store.rpc;
+                    } else if (teams.some(function (teamId) {
+                        // We're not allowed: check our teams
+                        var ed = Util.find(store, ['proxy', 'teams', teamId, 'keys', 'drive', 'edPublic']);
+                        if (allowed.indexOf(ed) === -1) { return false; }
+                        // This team is allowed: use its rpc
+                        var t = teamModule.getTeam(teamId);
+                        rpc = t.rpc;
+                        return true;
+                    })) {}
+
+                    if (!rpc) { return void cb('EFORBIDDEN'); }
+                    rpc.send('COOKIE', '', function (err) {
+                        cb(err);
+                    });
+                },
                 onConnectionChange: function (info) {
                     if (!info.state) {
                         channel.bcast("PAD_DISCONNECT");
diff --git a/www/common/sframe-app-framework.js b/www/common/sframe-app-framework.js
index 246991bfe..a72d69f1a 100644
--- a/www/common/sframe-app-framework.js
+++ b/www/common/sframe-app-framework.js
@@ -131,6 +131,8 @@ define([
             if (state === STATE.INFINITE_SPINNER && newState !== STATE.READY) { return; }
             if (newState === STATE.INFINITE_SPINNER || newState === STATE.DELETED) {
                 state = newState;
+            } else if (newState === STATE.ERROR) {
+                state = newState;
             } else if (state === STATE.DISCONNECTED && newState !== STATE.INITIALIZING) {
                 throw new Error("Cannot transition from DISCONNECTED to " + newState); // FIXME we are getting "DISCONNECTED to READY" on prod
             } else if (state !== STATE.READY && newState === STATE.HISTORY_MODE) {