It is a good practice to authenticate before, because this prevents
leaking information.

(also i removed the json error messages because they are ignored by
 nginx, if we want to tune them, then we should do it in the nginx
 configuration)