The recordSuccess and recordFailure methods of the AbstractValidationAction do not first check if the metrics registry has been installed into the runtime before obtaining and modifying a counter. The metrics registry can be null. 

This only surfaced when mocking up an authn flow test without first initializing the metric registry in the configuration service.  A successful authentication was triggering a NPE which then triggered an authentication failure.