> I notice that curl doesn't include the Authorization header on the first request, but I am out of my depth here.

That could be an interesting hint. In the latest snapshot [1], I have
removed the Authorization header from the first request. Can you check
if it makes a difference?

If not, could you share the headers of the second requests with us?

[1] https://files.basex.org/releases/latest/