Move exception into auth package, where it belongs