Authentication succeeds when it shouldn't

[dlundgren]

If you don't trigger an error during authentication then the code automatically calls setAuthenticated. It should not do this as it makes the system harder to use, and could provide access to the system if the credentials are identified.