don't update dontcheck until everything went fine: see usage in after_update_entity, where if we got an Unauthorized at hook time, we will retry and commit time.