For what it's worth, I'm adding all known plugin issues (and themes) to this post: https://wordpress.org/support/topic/issues-with-wordpress-401-and-shortcodes?replies=2

The tl;dr is rolling your OWN shortcode instead of using the API was dangerous anyway. :/ Now you know why.