I found out the reason.
First of all, to all who aren’t aware of what this error means (I sure wasn’t):
This exception is thrown if the server replies with a 401. Very intuitive, considering that it was thrown in getResponseCode() (i.o.w. you are never able to check for 401s yourself, but have to catch this IOException instead…).
The actual cause for the 401 was that I didn’t send an OAuth verifier code where it was expected at this point.