better handling of auth failures