Fixed invalid username sneak

Issue where if a username was not in the database it would be allowed in
because black password would be correct for a user that doesn't exist...