Update devDeps
Flash message options, return HTTP 400 if username/password missing

Do as passport-local does:
- provide possibility to define the flash messages used when calling
  passport.authenticate().
- rturn HTTP 400 when username or password is missing