SERVER-15098: funnel all auth errors to the correct status/checks