KEYCLOAK-388 - Auth SPI should be able to differentiate between the INVA...

...LID_USERNAME and INVALID_CREDENTIALS