Login gives better error feedback

* CSS was incorrectly applied to login error box so it wasn't displaying
  (sorry!)
* Errors were not being bubbled up from the User login methods
* We now differentiate between incorrect users/passwords and timeouts