auth: Split out badPwdCount update into a helper function