return false upon failure so WM returns a 401 instead of a 500