Index: roard/auth.c
===================================================================
--- roard/auth.c	(revision 4745)
+++ roard/auth.c	(revision 5146)
@@ -127,5 +127,6 @@
  for (i = 0; i < AUTH_KEYRING_LEN; i++) {
   if ( (key = &(g_auth_keyring[i]))->type == authmes->type ) {
-    ret = -1;
+   ROAR_DBG("auth_client_ckeck(cs=%p, authmes=%p, next=%p{%i}): key=%p{.type=%i, ...}", cs, authmes, next, *next, key, key->type);
+   ret = -1;
    switch (key->type) {
     case ROAR_AUTH_T_NONE:
Index: roard/clients.c
===================================================================
--- roard/clients.c	(revision 4947)
+++ roard/clients.c	(revision 5146)
@@ -1028,5 +1028,5 @@
    return _g_acclevs[i].acclev;
 
- return -1;
+ return ACCLEV_ERROR;
 }
 
Index: roard/include/client.h
===================================================================
--- roard/include/client.h	(revision 4708)
+++ roard/include/client.h	(revision 5146)
@@ -49,11 +49,12 @@
 // access level:
 enum roard_client_acclev {
- ACCLEV_NONE     = 0, // only very basic commands like NOOP and IDENTIFY
- ACCLEV_IDENTED,      // same as NONE but INDENTIFY worked.
- ACCLEV_CONCTL,       // only allowed to do basic connection things.
- ACCLEV_GUEST,        // guest connection (read only)
- ACCLEV_USER,         // normal user connect (read write)
- ACCLEV_PWRUSER,      // power user, may access other user's clients
- ACCLEV_ALL           // full (admin) access (read write ctl)
+ ACCLEV_ERROR    = -1, // used as erorr return value.
+ ACCLEV_NONE     =  0, // only very basic commands like NOOP and IDENTIFY
+ ACCLEV_IDENTED,       // same as NONE but INDENTIFY worked.
+ ACCLEV_CONCTL,        // only allowed to do basic connection things.
+ ACCLEV_GUEST,         // guest connection (read only)
+ ACCLEV_USER,          // normal user connect (read write)
+ ACCLEV_PWRUSER,       // power user, may access other user's clients
+ ACCLEV_ALL            // full (admin) access (read write ctl)
 };
 
Index: roard/req.c
===================================================================
--- roard/req.c	(revision 5065)
+++ roard/req.c	(revision 5146)
@@ -141,8 +141,13 @@
                            client, roar_autht2str(authmes.type), authmes.type, (long long unsigned int)authmes.len);
 
+ ROAR_DBG("req_on_auth(client=%i,...): CALL auth_client_ckeck(cs=%p, &authmes=%p, &next=%p)", client, cs, &authmes, &next);
  ret = auth_client_ckeck(cs, &authmes, &next);
+ ROAR_DBG("req_on_auth(client=%i,...): RET %i // next=%s(%i)", client, ret, roar_autht2str(next), next);
 
  if ( ret != 1 ) {
+  ROAR_DBG("req_on_auth(client=%i,...) = ?", client);
+
   if ( next != -1 ) {
+   ROAR_DBG("req_on_auth(client=%i,...) = ?", client);
    memset(&authmes, 0, sizeof(authmes));
 
@@ -152,6 +157,10 @@
     return -1;
 
-   if ( roar_err_int(&error_frame) == -1 )
-    return -1;
+   ROAR_DBG("req_on_auth(client=%i,...) = ?", client);
+
+   if ( roar_err_init(&error_frame) == -1 )
+    return -1;
+
+   ROAR_DBG("req_on_auth(client=%i,...) = ?", client);
 
    error_frame.ra_errno = ROAR_ERROR_PERM;
@@ -159,4 +168,5 @@
 
    error_data   = roar_err_buildmsg(mes, &error_frame);
+   ROAR_DBG("req_on_auth(client=%i,...): error_data=%p", client, error_data);
 
    memcpy(error_data, error_mes.data, error_mes.datalen);
@@ -164,7 +174,11 @@
    mes->cmd     = ROAR_CMD_ERROR;
    mes->pos     = g_pos;
+
+   ROAR_DBG("req_on_auth(client=%i,...): mes=%p{.datalen=%i}", client, mes, (int)mes->datalen);
+   ROAR_DBG("req_on_auth(client=%i,...) = 0 // cmd=ERROR", client);
    return 0;
   }
 
+  ROAR_DBG("req_on_auth(client=%i,...) = 0", client);
   return -1;
  }
@@ -173,4 +187,6 @@
  mes->pos     = g_pos;
  mes->datalen = 0;
+
+ ROAR_DBG("req_on_auth(client=%i,...) = 0", client);
  return 0;
 }
Index: roard/roard.c
===================================================================
--- roard/roard.c	(revision 5103)
+++ roard/roard.c	(revision 5146)
@@ -217,7 +217,8 @@
  printf("\nAuth Options:\n\n");
  printf(
-        " --guest-acclev ACCLEV - Sets the access level for guest access to ACCLEV\n"
+        " --guest-acclev ACCLEV - Sets the access level for guest access to ACCLEV,\n"
+        "                         Use \"none\" to disable guest access.\n"
         " --trust-acclev ACCLEV - Sets the access level for trust-authed\n"
-        "                         connections to ACCLEV\n"
+        "                         connections to ACCLEV. Use \"none\" to disable trust auth.\n"
         " --trust-root          - Trust root user\n"
         " --no-trust-root       - Don't trust root user\n"
@@ -1679,7 +1680,15 @@
    _CKHAVEARGS(1);
    none_acclev = clients_str2acclev(argv[++i]);
+   if ( none_acclev == -1 ) {
+    ROAR_ERR("Invalid access level: %s", argv[i]);
+    return 1;
+   }
   } else if ( strcmp(k, "--trust-acclev") == 0 ) {
    _CKHAVEARGS(1);
    trust_acclev = clients_str2acclev(argv[++i]);
+   if ( trust_acclev == -1 ) {
+    ROAR_ERR("Invalid access level: %s", argv[i]);
+    return 1;
+   }
   } else if ( strcmp(k, "--trust-root") == 0 ) {
    trust_root = 1;
