make sure that bad auth responses are tagged correctly