@abstractj wrt remove the default password.  how would i determine if the user typed the wrong credentials or actually needs to change the password if the exception is unauthorized.  am i able to check that the "stored" user has no password?