Instead of returning False when auth is incomplete, throw an exception which can be caught with a wrapper.