softmax is not enough (for sharp out-of-distribution)