don't require that an IdP supply a specific text string to indicate that the user is not authenticated

this is for issue #2339.  As part of the fix I wanted to ensure that errors not originating from the primary got shown under extended error information in the dialog.

Note to reviewer: I am not convinced my method of propagating error information is How We Do It.  Please review.