diff --git a/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java b/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
index 6c6474b..9855cd6 100644
--- a/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
+++ b/guacamole/src/main/java/org/apache/guacamole/extension/AuthenticationProviderFacade.java
@@ -21,12 +21,12 @@
 
 import java.util.Set;
 import java.util.UUID;
+import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.net.auth.AuthenticatedUser;
 import org.apache.guacamole.net.auth.AuthenticationProvider;
 import org.apache.guacamole.net.auth.Credentials;
 import org.apache.guacamole.net.auth.UserContext;
-import org.apache.guacamole.net.auth.credentials.GuacamoleCredentialsException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -190,41 +190,15 @@
             return authProvider.authenticateUser(credentials);
         }
 
-        // Pass through credential exceptions untouched, as these are not
-        // internal failures
-        catch (GuacamoleCredentialsException e) {
+        // Pass through client exceptions untouched, including credential
+        // exceptions, as these are not internal failures
+        catch (GuacamoleClientException e) {
             throw e;
         }
 
         // Pass through all other exceptions (aborting authentication entirely)
         // only if not configured to ignore such failures
-        catch (GuacamoleException e) {
-
-            // Skip using this authentication provider if configured to ignore
-            // internal failures during auth
-            if (isFailureTolerated()) {
-                warnAuthProviderSkipped(e);
-                return null;
-            }
-
-            warnAuthAborted();
-            throw e;
-
-        }
-        catch (RuntimeException e) {
-
-            // Skip using this authentication provider if configured to ignore
-            // internal failures during auth
-            if (isFailureTolerated()) {
-                warnAuthProviderSkipped(e);
-                return null;
-            }
-
-            warnAuthAborted();
-            throw e;
-
-        }
-        catch (Error e) {
+        catch (GuacamoleException | RuntimeException | Error e) {
 
             // Skip using this authentication provider if configured to ignore
             // internal failures during auth
@@ -274,41 +248,15 @@
             return authProvider.getUserContext(authenticatedUser);
         }
 
-        // Pass through credential exceptions untouched, as these are not
-        // internal failures
-        catch (GuacamoleCredentialsException e) {
+        // Pass through client exceptions untouched, including credential
+        // exceptions, as these are not internal failures
+        catch (GuacamoleClientException e) {
             throw e;
         }
 
         // Pass through all other exceptions (aborting authentication entirely)
         // only if not configured to ignore such failures
-        catch (GuacamoleException e) {
-
-            // Skip using this authentication provider if configured to ignore
-            // internal failures during auth
-            if (isFailureTolerated()) {
-                warnAuthProviderSkipped(e);
-                return null;
-            }
-
-            warnAuthAborted();
-            throw e;
-
-        }
-        catch (RuntimeException e) {
-
-            // Skip using this authentication provider if configured to ignore
-            // internal failures during auth
-            if (isFailureTolerated()) {
-                warnAuthProviderSkipped(e);
-                return null;
-            }
-
-            warnAuthAborted();
-            throw e;
-
-        }
-        catch (Error e) {
+        catch (GuacamoleException | RuntimeException | Error e) {
 
             // Skip using this authentication provider if configured to ignore
             // internal failures during auth
diff --git a/guacamole/src/main/java/org/apache/guacamole/rest/RESTExceptionMapper.java b/guacamole/src/main/java/org/apache/guacamole/rest/RESTExceptionMapper.java
index 9117947..e6c9b4c 100644
--- a/guacamole/src/main/java/org/apache/guacamole/rest/RESTExceptionMapper.java
+++ b/guacamole/src/main/java/org/apache/guacamole/rest/RESTExceptionMapper.java
@@ -27,6 +27,7 @@
 import javax.ws.rs.core.Response;
 import javax.ws.rs.ext.ExceptionMapper;
 import javax.ws.rs.ext.Provider;
+import org.apache.guacamole.GuacamoleClientException;
 import org.apache.guacamole.GuacamoleException;
 import org.apache.guacamole.GuacamoleUnauthorizedException;
 import org.apache.guacamole.rest.auth.AuthenticationService;
@@ -91,14 +92,25 @@
         }
         
         // Translate GuacamoleException subclasses to HTTP error codes 
-        if (t instanceof GuacamoleException)
+        if (t instanceof GuacamoleException) {
+
+            // Always log the human-readable details of GuacacamoleExceptions
+            // for the benefit of the administrator
+            if (t instanceof GuacamoleClientException)
+                logger.debug("Client request rejected: {}", t.getMessage());
+            else {
+                logger.error("Request could not be processed: {}", t.getMessage());
+                logger.debug("Processing of request aborted by extension.", t);
+            }
+
             return Response
                     .status(((GuacamoleException) t).getHttpStatusCode())
                     .entity(new APIError((GuacamoleException) t))
                     .type(MediaType.APPLICATION_JSON)
                     .build();
+        }
         
-        // Rethrow unchecked exceptions such that they are properly wrapped            
+        // Wrap unchecked exceptions
         String message = t.getMessage();
         if (message != null)
             logger.error("Unexpected internal error: {}", message);
diff --git a/guacamole/src/main/webapp/app/login/directives/login.js b/guacamole/src/main/webapp/app/login/directives/login.js
index a414548..b7967d7 100644
--- a/guacamole/src/main/webapp/app/login/directives/login.js
+++ b/guacamole/src/main/webapp/app/login/directives/login.js
@@ -72,6 +72,23 @@
         var requestService        = $injector.get('requestService');
 
         /**
+         * The initial value for all login fields. Note that this value must
+         * not be null. If null, empty fields may not be submitted back to the
+         * server at all, causing the request to misrepresent true login state.
+         *
+         * For example, if a user receives an insufficient credentials error
+         * due to their password expiring, failing to provide that new password
+         * should result in the user submitting their username, original
+         * password, and empty new password. If only the username and original
+         * password are sent, the invalid password reset request will be
+         * indistinguishable from a normal login attempt.
+         *
+         * @constant
+         * @type String
+         */
+        var DEFAULT_FIELD_VALUE = '';
+
+        /**
          * A description of the error that occurred during login, if any.
          *
          * @type TranslatableMessage
@@ -148,7 +165,7 @@
             // Set default values for all unset fields
             angular.forEach($scope.remainingFields, function setDefault(field) {
                 if (!$scope.enteredValues[field.name])
-                    $scope.enteredValues[field.name] = '';
+                    $scope.enteredValues[field.name] = DEFAULT_FIELD_VALUE;
             });
 
             $scope.relevantField = getRelevantField();
@@ -195,13 +212,11 @@
                     else
                         $scope.loginError = error.translatableMessage;
 
-                    // Clear all remaining fields that are not username fields
+                    // Reset all remaining fields to default values, but
+                    // preserve any usernames
                     angular.forEach($scope.remainingFields, function clearEnteredValueIfPassword(field) {
-
-                        // If field is not username field, delete it.
                         if (field.type !== Field.Type.USERNAME && field.name in $scope.enteredValues)
-                            delete $scope.enteredValues[field.name];
-
+                            $scope.enteredValues[field.name] = DEFAULT_FIELD_VALUE;
                     });
                 }