map Shibboleth/OpenSAML exceptions to mech errors