MDL-90 authenticate_user_login() - don't accidentally return a bogus $user

While I don't quite understand why we need that $user->id=0, at
_least_ make double sure we don't return it! Callers assume
that if we return an object===success and a user acct that just does
not exist will return an dummy object.

lib/moodlelib.php

@@ -3059,8 +3059,10 @@ function authenticate_user_login($username, $password) {
             }
         }
 
+        if ($user->id===0) {
+            return false;
+        }
         return $user;
-
     }
 
     // failed if all the plugins have failed