Create a CasMetric, so we can pass outright failures back more quickly.

Also, the third cookie wasn't always there for cas_login, so watch the
returned html for errors if cas says there are.