Use the `last_attempt_warning` configuration with the lockable unauthenticated_message message.

This configuration was added in #2687 but it was never used in the real code that
defines what message should be used by the app.

Fixes #3232.