[auth] error handling and stating