added TODO for future auth error handling