Probably don't want to return an attribute statement with a failed authentication