Should we log the real message but return to the user a more neutral error, like: "Internal system error, please contact an administrator" ?
Just wondering why you changed the name of this variable? I'm not feeling strongly, just being curious.
Mostly because authed isn't a word. authok isn't a word either, but a mash-up of two words, but it reads better to me.
I thought the purpose of the ticket was to return better information to the user why authentication failed.
Looks good to me.