authHandler should only worry about IO errors