Better handling of bad passwords to avoid login limiting.

[sendhil]

Reported by @aerych

Don't try to make calls with passwords that we know are invalid. This should help avoid tripping the .com login limiter and other login protection plugins on self-hosted sites.

[sendhil]

Comment from @koke in original Trac thread:

For reference, here are all the calls that might return a 403 error:

• wp.newPost: invalid post type / invalid term ID
• wp.editPost: invalid post type / invalid term ID
• wp.getPosts: invalid post type
• wp.newTerm
• wp.editTerm
• wp.deleteTerm
• wp.getTerm
• wp.getTerms
• wp.getTaxonomy
• wp.getUsers: invalid role
• wp.getComment: not allowed
• wp.deleteComment: not allowed
• wp.editComment: not allowed
• wp.newComment: not registered / invalid author/email
• wp.getCommentStatusList: not allowed
• wp.getCommentCount: not allowed
• wp.getPostStatusList: not allowed
• wp.getPageStatusList: not allowed
• wp.getPageTemplates: not allowed
• wp.setOptions: not allowed
• wp.getMediaItem: not allowed
• wp.getMediaLibrary: not allowed
• wp.getPostFormats: not allowed
• wp.getPostType: invalid post type

[sendhil]

Quite a few users on the support queue seem to hit this issue.

[sendhil]

Moving to 4.0.1.

[sendhil]

Moving to 4.1.

[sendhil]

Moving to 4.1.1.