Set error to 'Incorrect username or password' to not be quite as revealing. Closes #486