log api auth failures