Would it be silly to add in a safety belt in case a validate login callback mistakenly sets attempt.allowed to true? (e.g. immediately after each callback runs, we could make sure that attempt.allowed is equal to what it was before the callback ran)

I'm torn between "it's ridiculous to try to protect against all possible developer mistakes" and "extra safety belt can't hurt, and if somehow someone decides to set attempt.allowed to true for some silly reason, that definitely shouldn't cause the login attempt to succeed if a different callback returned falsey previously".

In fact, maybe we should just clone attempt before passing it into each callback?