Fixed a improperly written user step

I edited a user step that wasn’t properly testing if users were locked
out so it’s corresponding tests could pass.
Changed devise locales

I changed the invalid and not_found_in_database messages to reflect an
incorrect username or password rather than email. This does allow for
user enumeration, which is a security concern, but most likely won’t be
an issue for us, considering that our users will have publicly visible
accounts.