Add test for /auth/failure

Also fixed the code to work as intended.
Escape custom auth failure message to prevent XSS
Merge remote-tracking branch 'origin/fix_xss_in_auth_failure'