include reason in emitted auth failure log