better exceptions on login failure