Lesley Carhart 
One of my favorite modern cybersecurity design things is when something on the server side authentication fails instead of your actual credentials / MFA, but the failure error message is identical so you spend an hour doing resets and second guessing yourself only to have everything work perfectly a little later on.
Thomas Broyer@hacks4pancakes
```
try {
return doAuthenticationHandwaving(args);
} catch (Exception e) {
return ErrorState("Every error looks like a user error");
}
```