better failure when auth is incorrect