box: run box.session.on_auth triggers if the user doesn't exist

The triggers are supposed to run on any authentication attempt,
successful or not. Without it, the admin may not notice a malefactor
enumerating user names.

Closes #8017

NO_DOC=bug fix

(cherry picked from commit 8a2f1653)