Introduce auth rejection type AuthenticatorFail

* introduce AuthenticatorFail into Reject proto
* use authenticator returncode -3 as AuthenticatorFail