Unauthorized (401) when calling /api endpoints using default authentication and b.y.o. function app

**Describe the bug**

I have set up a Blazor SPA Static Web App and linked an existing functions app where all routes except `/.auth/*` require an authorized user (see `staticwebapp.config.json` below). This is not using custom authentication at all--just the default authentication and logging in with an invited/registered AAD user.

Even when authenticated all of my `/api` endpoints return `401 - Unauthorized`.

As a test, I opened up all routes to allow anonymous access, and it started working; however, _if I then log in using `/.auth/login/aad`, once I am authenticated all `/api` endpoints return `401 - Unauthorized` even though all routes should allow anonymous access_.

I am using an HTTP client initialized in the following way:

```C#
var builder = WebAssemblyHostBuilder.CreateDefault(args);
builder.RootComponents.Add("#app");

var baseAddress = builder.Configuration["API_Prefix"] ?? builder.HostEnvironment.BaseAddress;
builder.Services.AddScoped(_ => new HttpClient { BaseAddress = new Uri(baseAddress) });
builder.Services.AddSingleton();
builder.Services.AddBlazorFluentUI();

await builder.Build().RunAsync();
```

I have confirmed that all cookies are transmitted (including the static web auth cookies) when I make the get/post calls.

Here's my `staticwebapp.config.json`:

```json
{
"navigationFallback": {
"rewrite": "/index.html",
"exclude": [
"/images/*.{png,jpg,gif}",
"/css/*"
]
},
"routes": [
{
"route": "/.auth/*",
"allowedRoles": [ "anonymous" ]
},
{
"route": "/*",
"allowedRoles": [ "authenticated" ],
}
],
"responseOverrides": {
"401": {
"redirect": "/.auth/login/aad",
"statusCode": 302,
"exclude": ["/api/*"]
}
}
}
```

*possibly Important note*: This app worked yesterday, but does not today, with no new deploys (although now I have tested a ton of iterations on the routes and config).

**Expected behavior**
I expect that `/api` endpoints do not return 401 when the user is authenticated.
I expect that `/api` endpoints are always accessible when anonymous routes are allowed.

**Device info (if applicable):**
- OS: Windows 11
- Browser: Edge (Chromium)
- Version: 93.0.961.52 (Official build) (64-bit)
- Visual Studio 2022
- .NET 6.0
- Function App v4

**Additional context**

The project is not public, but I can provide access to anyone investigating this issue. I can also provide the link to the deployed and an invite to the app's auth.