Correctly encode passwords and report nonexisting users as wrong credentials