You are not logged in.
In TOnAuthentificationFailed UserName and Password are declared as string, but all other places (SetUser, TSQLAuthUser) uses RawUTF8, I believe TOnAuthentificationFailed should be changed to RawUTF8 as well.
Offline
No, this is on purpose, AFAIR.
The TOnAuthenticationFailed callbacks are meant to be implemented on the client side, directly from the UI.
So it expects string parameters, to directly access the VCL components.
Online