Thanks for the clarification. This does make sense. I was just debating which it'd be easier; to tweak the authentication handler to customize which exceptions should actually be thrown and thus mapped, or let it throw everything and allow the adopter to modify the state map. Nonetheless, for the time being it might be that modifying the handler would be the better choice in a way that it is the component most adopters are concerned with and making adjustments to the handler is pretty much a norm. Tweaking the handler also works nicely for a custom and special LPPE AuthN handler in general that I had previously intended to design. 

Thinking out loud, the other concern here is that extending the state map would be somewhat difficult, should we come up with new exceptions to catch as part of LPPE but that isn't a very probable case in the near future.