what does it return when auth fails?