handle login failures better