When a user enters an invalid username or password shouldn't a notification appear to notify the end user of the failure?
For instance, UserEmailIsNotConfirmedAndCanNotLogin.
