> Also, having separate warnings for your username and password matches is a bad security practice. Best to just say "username/password combination not found" instead of letting a potential hacker know he's stumbled upon a valid username.

I don't see why that's generally going to be a security flaw; most services already indicate if a username is taken when signing up so a hacker can poll for random names there instead.