more forward-auth fixes, catch any exception during handshake