Change in OSG and Walrus auth handlers to use service-path-less canonicalization first instead of as backup

Also fixes some exception handling around login failures to indicate the reason to the user more clearly.