better error handling for EXTERNAL AUTHENTICATION