look for # error fragments and standard url param errors, like the user clicked deny on the auth page