failed login no longer send INVALID_LOGIN error code
now it sends USERNAME_INVALID and PASSWORD_INVALID