The code here can re-throw the exception if it's not AuthenticationFailed but still keeps the `_failed` flag as false. Call `_markFailed(kSetFlag)` before throwing.

Investigate if this problem occurs in later branches too.