Why "Invalid email or password" instead of "Email not found"? Security: if we say "email not found", an attacker knows that email isn't registered and can try other emails. If we say "password ...