Don't let the client know if it is a bad email or password when logging in.