Add failing test case for bad parameter sanitizing when failing to login

Failing test for #2440. This was hard to track down because the implementation for StrongParameters' `action_on_unpermitted_parameters` either doesn't work or isn't documented correctly and it doesn't seem to raise an error as expected.