Don't give extra information on failed login

[SamuelPull]

Frontend message is correct in hiding whether the user or password is incorrect (Incorrect login ID or password), however, inspecting response body shows the difference. Message for existing user is "authentication failed: authentication failed for mstein: authentication failed", and the message for non-existent user is "authentication failed: authentication failed for janko: authentication failed: Not found: user janko". Such information should not be revealed.

• Error message propagated to the browser should be the same whether username exists or not - authentication failed
• Update tests, if required