I had expected the "password about to expire" condition to be modeled as a Message passed up the stack via HandlerResult. I would like to model authentication failure as an exception, and everything else (e.g. warnings) as Messages or some other type associated with HandlerResult. That way the mechanics of authentication can be clearly documented and followed precisely.