diff --git a/web.go b/web.go
index a87cc90..cd60001 100644
--- a/web.go
+++ b/web.go
@@ -70,10 +70,10 @@ func verifyHostname(cfg *Config, user *User, hostname string) (string, *RRConfig
 	// check whether the authenticated user is allowed to update the dns record
 	_, ok := user.records[hostname]
 	if !ok {
-		return "nohost", nil
+		return "badauth", nil
 	}
 
-	// this should not fail as it is verified in LoadConfig, but better be sure
+	// this should not fail as it is verified in LoadConfig, but better be safe
 	entry, ok := cfg.rrconfigs[hostname]
 	if !ok {
 		return "nohost", nil
@@ -81,6 +81,9 @@ func verifyHostname(cfg *Config, user *User, hostname string) (string, *RRConfig
 
 	// TODO: return notfqdn -> differentiate between 'hostname doesnt exist' and
 	// 'hostname is not fqdn'
+
+	// again, this should not fail since 'hostname' was the key used for
+	// cfg.rrconfigs to acquire the entry
 	if hostname != entry.Recordname {
 		return "nohost", nil
 	}