basic auth failures have a 'fail' status too, but with a status code