do we need to distinguish between `E_AUTH_ERROR` and `E_UNAUTHORIZED` (I prefer just the latter...)