Shouldn't we raise a suitable authentication error here?