mark parse errors explicitly
style, more safety for parse_auth