Check for WP_Error on wp_authenticate_user

[kovshenin]

When something returns a WP_Error during authentication (like an invalid password), we shouldn't be trying to access ->has_cap() of that error object, but rather return it immediately.