Throw "401 Unauthenticated" when authentication is provided but invalid

E.g. with an AppToken that has been revoked

Signed-off-by: Joas Schilling <coding@schilljs.com>

lib/private/User/Session.php

@@ -599,6 +599,8 @@ class Session implements IUserSession, Emitter {
 
 					return true;
 				}
+				// If credentials were provided, they need to be valid, otherwise we do boom
+				throw new LoginException();
 			} catch (PasswordLoginForbiddenException $ex) {
 				// Nothing to do
 			}