Changed the error message for no user found and multiple users found to be the normal invalidCredentials.  We don't want a user to be able to determine whether a user exists or not.