I'll returns BadPermission. I think it is the best match for incorrect password.