`.code` of primaryError implies we actually received a response from the primary - that their javascript loads ok and calls the functions we provide.  As long as that is the case we assume that the user is not authenticated.

Recall the flow here:
1. dialog load
2. 1st provisioning attempt
3. if fails, direct to authentication screen
4. upon redirect back, 2nd provisioning attempt.  

So this change means if `.raiseProvisioningFailure` is called on the first attempt, we'll always go to authentication.  Before, this was only if the IdP provided the exact string `user is not authenticated as target user`