add auth fail condition