ENG-7058: Don't count authentication attempts with empty credentials as failed attempts.

So that subsequent successful attempts won't be rejected because of the rate-limit.
Can this be in its own catch so no instance of check is needed.