Turns out there's more than one way to deny a login