[BC break] /authenticate returns the same error for both non existing user and invalid password