Keystone returns an {error, Reason} pair if a user can't be authenticated.