since the command dispatcher expects dicts now

We were caching sessions even when the authentication has failed,
making impossible to try again with a different password.

- Resolves: #8226

In the case of wrong username/password the failure returned was
'Authentication hook did not return anything'. Right now the
original failure is returned, and the producer of the failure can
put a more meaningful message.

- Resolves: #8399

To avoid using None as a valid (token, uuid) pair we need to raise an
exception.

Logout does not need password.