diff --git a/security/auth.go b/security/auth.go
index 662206e..c8b68e0 100644
--- a/security/auth.go
+++ b/security/auth.go
@@ -47,6 +47,8 @@ func Validator(setting *model.Setting) func(name, pwd string) (ticket string, er
 				}
 				err = biz.User.Create(mu, nil)
 			}
+		} else {
+			err = certify.ErrInvalidToken
 		}
 
 		// replace user session, one session is allowed per user.