Genericize invalid username or password message

https://github.com/meanjs/mean/issues/133
The message given to the user upon an invalid login attempt, for security reasons, should not reveal that the username or password was incorrect.  Rather, a generic message should be displayed when the username or password is incorrect.

config/strategies/local.js

@@ -22,12 +22,12 @@ module.exports = function() {
 				}
 				if (!user) {
 					return done(null, false, {
-						message: 'Unknown user'
+						message: 'Unknown user or invalid password'
 					});
 				}
 				if (!user.authenticate(password)) {
 					return done(null, false, {
-						message: 'Invalid password'
+						message: 'Unknown user or invalid password'
 					});
 				}
 
@@ -35,4 +35,4 @@ module.exports = function() {
 			});
 		}
 	));
-};
+};