Invalid CN triggers auth failure

For an account which has authenticated previously but is now providing an invalid CN the realm checks to attempt to get giveName or surname fail with Array OOB. This needs to be captured and more cleanly handled.

Does not impact AAF Base which FR needs to migrate to.