ENG-7058: Don't count authentication attempts with empty credentials as failed attempts.

So that subsequent successful attempts won't be rejected because of the rate-limit.
No. The checks below make sure that if any credential is given, it will back pressure. Only empty credential is special cased.