anchor.diff:    Future<T> Function(http.Client) fn,
   ) async {
     final credential = systemCache.tokenStore.findCredential(hostedUrl);
  -  final http.Client client = credential == null
  -      ? httpClient
  -      : _AuthenticatedClient(httpClient, credential);
  +  final http.Client client = _AuthenticatedClient(httpClient, credential);
   
     try {
       return await fn(client);
  -  } on PubHttpException catch (error) {
  -    if (error.response?.statusCode == 401 ||
  -        error.response?.statusCode == 403) {
  -      // TODO(themisir): Do we need to match error.response.request.url with
  -      // the hostedUrl? Or at least we might need to log request.url to give
  -      // user additional insights on what's happening.
  +  } on AuthenticationException catch (error) {
  +    String message;
   
  -      String serverMessage;
  +    if (error.statusCode == 401) {
  +      if (systemCache.tokenStore.removeCredential(hostedUrl)) {
  +        log.warning('Invalid token for $hostedUrl deleted.');
  +      }
  +      message = '$hostedUrl package repository requested authentication! '
  +          'You can provide credential using:\n'
  +          '    pub token add $hostedUrl';
  +    }
  +    if (error.statusCode == 403) {
  +      message = 'Insufficient permissions to the resource in $hostedUrl '
  +          'package repository. You can modify credential using:\n'
  +          '    pub token add $hostedUrl';
  +    }
   
  -      try {
  -        final wwwAuthenticateHeaderValue =
  -            error.response.headers[HttpHeaders.wwwAuthenticateHeader];
  -        if (wwwAuthenticateHeaderValue != null) {
  -          final parsedValue = HeaderValue.parse(wwwAuthenticateHeaderValue,
  -              parameterSeparator: ',');
  -          if (parsedValue.parameters['realm'] == 'pub') {
  -            serverMessage = parsedValue.parameters['message'];
  -          }
  -        }
  -      } catch (_) {
  -        // Ignore errors might be caused when parsing invalid header values
  -      }
  +    if (error.serverMessage?.isNotEmpty == true) {
  +      message += '\n${error.serverMessage}';
  +    }
   
  -      if (error.response.statusCode == 401) {
  -        if (systemCache.tokenStore.removeCredential(hostedUrl)) {
  -          log.warning('Invalid token for $hostedUrl deleted.');
  -        }
  -
  -        log.error(
  -          'Authentication requested by hosted server at: $hostedUrl\n'
  -          'You can use the following command to add token for the server:\n'
  -          '\n    pub token add $hostedUrl\n',
  -        );
  -      }
  -      if (error.response.statusCode == 403) {
  -        log.error(
  -          'Insufficient permissions to the resource in hosted server at: '
  -          '$hostedUrl\n'
  -          'You can use the following command to update token for the server:\n'
  -          '\n    pub token add $hostedUrl\n',
  -        );
  -      }
  -
  -      if (serverMessage?.isNotEmpty == true) {
  -        // Only allow printable ASCII, map anything else to whitespace, take
  -        // at-most 1024 characters.
  -        final truncatedMessage = String.fromCharCodes(serverMessage.runes
  -            .map((r) => 32 >= r && r <= 127 ? r : 32)
  -            .take(1024));
  -
  -        log.error(truncatedMessage);
  -      }
  -    }
  -    rethrow;
  +    throw DataException(message);
     }
   }
  
positive.code: ///
  /// Requests to URLs not under [serverBaseUrl] will not be authenticated.
  class _AuthenticatedClient extends http.BaseClient {
    _AuthenticatedClient(this._inner, this.credential);
  
    final http.BaseClient _inner;
  
negative.code: 
  import 'dart:io';
  
  import 'package:collection/collection.dart';
  import 'package:http/http.dart' as http;
  import 'package:http_parser/http_parser.dart';
  
  import '../exceptions.dart';
  import '../http.dart';
  import '../log.dart' as log;
  import '../system_cache.dart';
  