Do not distinguish between non existing user and wrong password. Return same error message for both events.
Do not distinguish between non existing user and wrong password. Return same error message for both events.