Tracking Protocol Deviations with Auth Codes