Authentication backends can now specify the reason for failure.