bad credentials don't work, error displays