authentication failure reasons in IdP logs

[Cantor, Scott]

Just FYI, I worked around the JAAS error handling behavior in my login
handler by running each JAAS module separately so I could capture the
errors and deal with them. I created a precedence so that password
failures would trump invalid username errors, so I could respond with the
"best" message possible.

We have the machinery for that in 3.0, but not the specific flow that
would run multiple JAAS modules, because there's no way to predict what
people need to do, but it's easy after some learning curve to build a new
login flow copying the basic one that adds additional "validate" steps
that will check different stores.

-- Scott