If we don't do this, we end up calling onAuthenticated _after_ callin onAuthenticationProblems.

This isn't a very principled solution, since other similar situations aren't covered.
And, we may fail 'ensureCapabilities' for reasons other than authentication (e.g. network failures).

Arguably, stopping here _is_ better than progressing with an uncertain state.