gracefully handle bad oauth credentials