login throttling uses the identity, login() in strategies need to return identity as part of login failures