let user know if their username / password are invalid