log token on failed auth