Use AuthenticationCompletionException if the negotiation can not continue

[sberyozkin]

It will avoid some possible loops with the challenge, and 500s instead of 401s as it is probably better report 401 if Login fails for whatever reasons