How does this work, exactly? Are we replying "Invalid credentials" whenever there's a 404?