Shouldn't check_response be true? How will the user know that authentication failed?