fix: login error message with locale set

On a failed login the warden failure app gets called. Some of the params are changed accordingly but controller and action remain. set_locale would detect there was no locale in the path and thus attempt to redirect. However the params still belong to the previous request which was a POST to Api::SessionsController. This route does not respond to get requests and so it would trigger a 404 in production and a 500 in development.

This commit prevents set_locale to act upon warden failure app controller calls by adding /new to the list of NON_LOCALE_PATHS. (The path is updated by warden to the name of the action called in the failure app).

A test is included in this commit that tries to login with an invalid username, password combination and a german locale set.

fixes #8805 (closed)