failing authentication should always raise an error
session should not return an error if not logged in
error handler alway raises an error