Return auth failure as 400

Rather than the nasty hack here to set an exception detail message
to a dictionary, set it to the reason string. The ajax form handler
we have already handles the 400 case by sending the detail message
as the value of the "reason" key in the response. The only thing
needed is to catch and return the exception in the login view so
that the ajax form handler sees the response rather than Pyramid
trying to resolve an exception view.

Fix #1660