I know it's not part of this PR - but for security reasons, should we not be giving this much info away in our error messages?