                             successful    : false
                             email_address : mesg.email_address
                             account_id    : account.account_id
-                        sign_in_error(error_mesg)
+                        sign_in_error("Incorrect password.")
                         cb(true); return
                     else
 


        # get account and check credentials
        (cb) ->
            # Do not give away info about whether the e-mail address is valid:
            error_mesg = "Invalid e-mail or password."
            database.get_account
                email_address : mesg.email_address
                consistency   : 1

                            ip_address    : client.ip_address
                            successful    : false
                            email_address : mesg.email_address
                        sign_in_error("There is no account with email address #{mesg.email_address}.")
                        cb(true); return
                    if not is_password_correct(password:mesg.password, password_hash:account.password_hash)
                        record_sign_in
