I do not understand the logic here - perhaps because I do not have a view of the entire flow - but it seems convoluted.

Do we have an exception or earlier return point in the code to know that we at this point always have a failed login?