Update messages; don't pass through errors

For security, we shouldn't pass through the underlying
error to the user.  Instead, tell them the email address
or password is invalid.

Similarly, since we're only using email addresses now and
not usernames, the error message should mention the
email address.