throw an exception when auth fails