When attempting to login, the error messages should not leak information...

... about whether a username is valid.

This also means the error message is more appropriate if somebody tries to login with somebody else's username and their password.