Extend the workaround for messages on failed login attempts.

The previous version was just a deduplication, so that
instead of 3 messages, the user was only shown 2.

Now we swallow the second one, so there is only one, saying
  "Invalid username or password",
or something similar. (After this, there is no need to say
that the submission was invalid, since it's obvious.)