Remove "special" multisite spam check in the authentication API.

The spamming of a site no longer directly affects a user of said site.

Moves the spam check to the wp_authenticate filter. Networks in need
of enhanced spam-fighting should leverage this same technique.

Allow is_user_spammy() to accept a WP_User object.

props willnorris, brianhogg.
fixes #24771. see #19714.



git-svn-id: http://core.svn.wordpress.org/trunk@24848 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Avoid racing TinyMCE, which avoids the creation of unnecessary autosaves. props azaozz. see #7392.



git-svn-id: http://core.svn.wordpress.org/trunk@24849 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Don't override an existing WP_Error object in wp_authenticate_username_password().

props willnorris.
fixes #19714.



git-svn-id: http://core.svn.wordpress.org/trunk@24850 1a063a9b-81f0-0310-95a4-ce76da25c4cd