using Error and JSON to fail auth