created a new callback for collecting hits from an elastic SEARCH request
short-circuit failure of the authentication system if the user attempts to auth using non-approved user-type-name or identity-field-name; this allows the system to define multiple modes of identification (user ID, email address, username, etc)
use the new HitCollector callback to retrieve hits from the user query; if we don't get exactly one result, send an authentication failure