The UI will make use of a 'status' field if one is present for displaying the actual error code we are displaying.  I would suggest that we set err.status to 'AUTH' for this one and 'ERR' for the inferred case.  Or something techy-opaque that looks important.

Actually, it might make sense to do this in the server-maintenance cases too.  Like ERR for the 'greeting' and whatever matched the reg-exp (or maybe the full first word-until-whitespace to get SYS/PERM versus SYS/TEMP for info) for the explicit cases.

And for 'bad-security', that makes sense too.