access: cache: free all entries on failure

While unlikely, if the url strdup failed but the username strdup succeeds, this would have leaked the username entry.

Fix CID 1665566