Auth controller needs to propagate errors