better error message when authn servlets are accessed directly