session: decline bad auth credentials