Genericize invalid username or password message

#133
The message given to the user upon an invalid login attempt, for security reasons, should not reveal that the username or password was incorrect.  Rather, a generic message should be displayed when the username or password is incorrect.

config/strategies/local.js

@@ -22,17 +22,17 @@ module.exports = function() {
 				}
 				if (!user) {
 					return done(null, false, {
-						message: 'Unknown user'
+						message: 'Unknown user or invalid password'
 					});
 				}
 				if (!user.authenticate(password)) {
 					return done(null, false, {
-						message: 'Invalid password'
+						message: 'Unknown user or invalid password'
 					});
 				}
 
 				return done(null, user);
 			});
 		}
 	));
-};
+};