Revise the way that auth is handled

* backwards support for standard text/html requests
* error handling for auth failure is more specific