A failed login should not broadcast details of the attempt #305
Description
This service currently logs whether a username is registered or not when a failed login attempt is made. This is poor practice from a security perspective.
If there is an API failure (we couldn't talk to the service to find out if the email is registered) -> display an error page
Not registered -> display the 'we sent an email to that user with details' page
Registered -> display the 'we sent an email to that user with details' page
At no point should either the password or username/email address form data be logged (because some user will undoubtedly put their password in the username field that will then end up in our log files as plaintext).