Simplify credential checking.

I was being too paranoid about timing. If the user has authenticated, which
particular credential pair was matched isn't sensitive. While we don't want to
allow username enumeration, short-circuiting on valid credentials shouldn't be
an issue.