Ensure correct behaviour when the user is unknown

Ensure correct behaviour when the user is unknown

This is not a big deal for us, since in this codebase it's equivalent
to the password being wrong, etc. However:

- We should be testing all potential behaviours, irrespective of how we
  implement things under the hood.

- If we integrate a third-party solution for authentication, this
  may be different. It's indeed a different code path in Devise,
  so this PR reduces the size of a potential future Devise PR.