fix(security): harden login failure responses and authentication state persistence

fix(security): harden login failure responses and authentication state persistence #58