Fix then param, login failure reason rendering

Add test for redirect preserving then param
Add password authenticator that calls out to external basic auth-protected endpoint