HttpResponse objects via authenticate() will now stop view execution

Prior to this change, `authenticate()` methods defined on an `Endpoint` which returned `HttpResponse` objects were ignored. The logic did a good job checking for `None` and invalid objects, but if a valid object was returned ... it wasn't enforced.

Now the response from `authenticate()` is stored and if it is not `None` (which means it's a valid response object) execution is stopped and that response is sent directly to the user.