Use InvalidCredentials and also add email auth stuff

cc @lukmdo 
InvalidCredentialsError here ?