It seems that if a single login plugin is configured, when the user misenters their password, they just get sent to login_return, not a message with retry.
Log in to comment on this ticket.