How about `#require_authentication` or `#deny_access`?

And maybe you should set a default value (`nil`, for instance) for `exception`, allowing us to call (for some reason) `#auth_error` inside an action, since we are not using the variable.