box: don't stop parsing authentication request if user doesn't exist

Currently, we stop without checking the authentication request body if
the specified user doesn't exist. As a result, one can check if a user
exists by sending a malformed authentication request: for an existing
user, the server will reply with ER_INVALID_MSGPACK error while if the
user doesn't exist, the error will be set to ER_CREDS_MISMATCH. To fix
this, let's parse the authentication request body even if the user
doesn't exist.

Closes https://github.com/tarantool/security/issues/21

NO_DOC=bug fix