Do not throw UnauthorizedException, just do not log in the user