The api returns a different message for an invalid username and an invalid password.
For security reasons, these should be the same messages, otherwise a brute force can obtain valid usernames...