o.c.security: Login errors resulted in NPE and hid the actual error

Fixes #578 :  Failed log in leaves state as is (previous user, ..) and no more NPE in SecurityVariables.java if subject, authorizations, .. are empty