changed the error message for failed login
no longer uses a random string