Stop raising every client error as `invalid_credentials`.

When a user declines logging in with a certain provider, the `fail!`
method will be called with the argument `user_denied`, `access_denied`
or whatever error message the provider returns.

When a CSRF attack is detected, the `fail!` method will be called with
the argument `csrf_detected`.
Improve the CSRF exception message.