better response when username or password isn't submitted