You're assuming their internal tools have the same fields and field validation requirements as public-facing login mechanisms, while is likely not the case.