Username / password errors should not specify which had the problem

We should not have a separate message for bad user and bad password, should just always say “password failure”