Hrm... I think this needs some reworking. All 3 reviewers were kinda confused by knownUserId =)

A couple ideas:

1) just get rid of it. Callsites can already return an object with userId set and not allowed. I think all the current callsites that do this (know a userid but can reject) can simply change a throw into a return. Much simpler.

2) define a new exception class LoginError and have login handlers throw this instead when the want to report "clean" failure (eg, an expected case, not a programmer error)