The authentication code assumed that the initial request only had authentication related data. This is not true if the client library predicts that the authentication will succeed and it sends a query right after it sends the authentication data.