Replace invalidUser with badAttempt

[MGatner]

There are a few references to lang('Auth.invalidUser'), which doesn't exist. Rather than adding that string this PR replaces the references to the existing language string badAttempt, as it is generally better to be opaque about whether the user account exists or not on login attempts.

[lonnieezell]

I don't remember where I read it but somewhere in the last year or two I'd seen it suggested that being opaque doesn't actually aid security that much only serves to frustrate users.

I'm not finding that link at the moment, but I'm ok with making this change for now.

[MGatner]

Gotcha. Well if you decide you want a separate "user not found" message that would be easy to add and change this back.