throw out an exception when plain auth failed