fixed a bug that caused only the first authentication attempt to be
handeled correctly. further failed attemts caused exceptions because the
same response object was reused (that's not possible...)