on the topic of logging, we should definitely log all failed authorization attempts with `logging.INFO`
if we get loads of failed auth attempts, we may need to add some kind of rate limiting