[4.2] Auth : call where only once in auth

Instead of calling`where` many times, we can call it only once as `where` accepts an array as an argument.
Also ensure the password field is `password`, and not a field containing which name contains `password`
Which clearly break reset password code. <https://github.com/laravel/framework/blob/master/src/Illuminate/Auth/Reminders/PasswordBroker.php#L190>