Fix improper login param sanitization permit

This includes a failing test case that hooks into ActiveSupport
Notifications to catch the param permit error.
Merge pull request #2452 from latortuga/bad-strong-params-on-failed-login

Add failing test case for bad parameter sanitizing when failing to login