better failed auth handling