Fix brute force vuln due to callbacks not being ran (#235)
Fix brute force vuln due to callbacks not being ran (#235)

The authenticate method previously would return before callbacks executed if an
invalid password was provided, which causes the brute force protection to only
work for the first lockout period, and only resets after a successful login.

Fixes #231
Sorcery/sorcery,Sorcery/sorcery,athix/sorcery,athix/sorcery,athix/sorcery,Sorcery/sorcery