Return a different error code for "service won't work" than "auth failed"
    
    If we bubble it up to the greeter then we should be able to have
    a more sensible UI when e.g. fingerprinting isn't enabled.