--- a/plugins/mod_legacyauth.lua	Mon Dec 23 22:30:21 2019 +0100
+++ b/plugins/mod_legacyauth.lua	Mon Dec 23 23:11:28 2019 +0100
@@ -78,8 +78,10 @@
 					session:close(); -- FIXME undo resource bind and auth instead of closing the session?
 					return true;
 				end
+				session.send(st.reply(stanza));
+			else
+				session.send(st.error_reply(stanza, "auth", "not-authorized", err));
 			end
-			session.send(st.reply(stanza));
 		else
 			session.send(st.error_reply(stanza, "auth", "not-authorized"));
 		end