#770598 by greggles, grendzy: move user login failure attempt logging to user_authenticate() to have unified logging with all kinds of authentication schemes, including blogapi