Even authentication errors are JSON