sources-discoverer: Don't misinterpret 403 and 405 HTTP error codes as prompts for credentials

Builds on top of !423 (merged) for testing convenience, though it could presumably be merged independently too.

Fixes #645 (closed) and presumably fixes #552 (closed)