ENG-7058: Don't count authentication attempts with empty credentials as failed attempts.

So that subsequent successful attempts won't be rejected because of the rate-limit.
I didn't want to change the type of exception so as to not break the API if other code is relying on catching IOException only. This way existing code will still work and gives me the chance to identify authentication failure.