Instead of one MatrixAuthenticate() function, we'll do MatrixGetAccessToken(), and then UserAuthenticate(). This allows us to give different error messages depending on what the user provided and what the server state is.