better error message for login failures