Use new api responses to direct authentication behavior and throw meaningful exceptions