Switch to emails instead of usernames, make it vague when you fail login