Handling HTTP errors resulting from key requests

I am running into this case while debugging and it is not clear from the spec how to handle this. 

Here is the use case I am thinking about —
* Application starts playback of encrypted stream
* UA sends needKey to app - app responds by creating a session
* CDM sends key request to app
* App forwards key request to server via XMLHttpRequest
* Server responds with something other than HTTP/200
* App does what exactly?

At this point we are in a grey area — if the error is something related to auth, the handling is probably straight-forward and the EME philosophy indicates the app should handle it. But if the error is anything else, the only option I see is closing the session and opening a new one.  Does this sound correct to everyone?

I am concerned that the CDM is *only* notified in the success case. The CDM might be able to offer an alternative request URL when errors are encountered, however there is no mechanism for this currently.

Joe