Added tests to AuthenticationModule:
(1) SSO credential validator has precedence, and must always be called first.
(2) failed password authentication returns no candidates.