and report an appropriate error message
also started on authentication code (I'm doing a challenge response system initially)