Make invalid credentials less informative

[fmigneault]

• No specific invalid user/password, just a single generic "invalid credentials".
• Display with banner.

As discussed in meeting: https://www.crim.ca/confluence/pages/viewpage.action?pageId=21761637

[dbyrns]

@huard : We discussed about that in a meeting (see ref) and we agreed that telling specifically that a user doesn't exist could be exploited. The good practice is to tell that a user/password combinaison isn't correct. This way someone cannot guess first a valid user and then guess it's password. If you want to see that in action try to log to github with an invalid username. It will never let you know that this user doesn't exist.

[huard]

Got it. As long as the message is clear, I'm good. E.g "Your login information is incorrect, check your username and password."

[fmigneault]

resolved via PR #64