Login error message bug fix

Small fix to show login error correctly and another change to make sure that the app does not reveal which one was wrong username or password (for security reasons).

src/tjts5901/auth.py

@@ -156,7 +156,7 @@ def login():
     if request.method == 'POST':
         email = request.form['email']
         password = request.form['password']
-
+        user = None
         error = None
         try:
             user = User.objects.get(email=email)
@@ -164,9 +164,9 @@ def login():
             error = 'Incorrect username.'
 
         if user is None:
-            error = 'Incorrect username.'
+            error = 'Incorrect username or password.'
         elif not check_password_hash(user['password'], password):
-            error = 'Incorrect password.'
+            error = 'Incorrect username or password.'
 
         if error is None:
             remember_me = bool(request.form.get("remember-me", False))