I think that we should stick with the expected pattern in Drupal:
  - There user could be identified: a user object is loaded.
  - The user could not be identified: no error is generated and the anonymous user is loaded.

What we could do is add some sort of HAL like `_messages` section with a warning saying that the credentials are wrong. But altering the execution flow based on user roles (`authenticated user` vs `anonymous user`) seems authorization to me.