throw AccessDeniedHttpException on bad username/password combination