auth prompt; handle errors according to spec