ENG-7058: Don't count authentication attempts with empty credentials as failed attempts.

So that subsequent successful attempts won't be rejected because of the rate-limit.
Does this also mean bad credentials will never be back pressured?