Make authenticated_userid None when groupfinder returns None.

This matches the behaviour of Pyramid's CallbackAuthenticationPolicy.

It's useful to be able to deny authentication from the groupfinder.