If that is the justification, then the possible error responses could be: 1. Username is incorrect, or 2: Username or password is incorrect. If no user exists with that username, then you can just tell the user that the username is incorrect.