handle auth failure