I don't think you should tell the user if they entered the wrong username or password. It opens up a possibility for "evil" users to find a correct user name, and then they can start trying passwords, right?