correct to flow

forgot to call the var allow_bypass correctly, also moved the error
message towards the end of the user flow so we pick up only the errors
we wish to see.  Corrections to what the issues are when signing in to
not say it's your username or pass but that it could be either.  Don't
want to tip hats here