Assume that this method is invalid if there is a password in play

Hey! I hate to bug you so much, but if I throw a pull request your way for devise_harvard_auth_proxy, can you test it for me on your dev instance of CRT?

I currently don't have any way to test pin stuff.  I think this should fix the "kicks user to pin if they enter a bad username/password