We should not have a separate message for bad user and bad password, should just always say “password failure”

Thanks,

Shawn.