fixed bug where on_authentication_fail() was not always called