The spec said send false or close and another auth challenge, unless I read it wrong.  The very first thing I send is auth but clients usually connect and send before checking.. I could modify to just do one auth challenge ya..