modified ChallengeUser to accommodate mode=xml + refactored for login failed