Return 422 if user is not found or password is incorrect

## Return 422 if user is not found or password is incorrect

### Acceptance Criteria
1. OAuthController returns 422 if the username (email) is incorrect or the password is wrong.

### Tasks
- Change response status codes.
- Clean up the code.
- Add unit tests.

### Additional Notes
- None
We've been using $captured for stuff like this. Any particular reason you decided to do it this way?