Don't advise the specifics of login failure

Avoid providing additional information to potential hackers, i.e. they now know the username exists and can target the password.