Yeah - this was broken - hence no error message being shown at all server-side when the error message was returned under the new_pin key.