If the user enters some space at the start or end of the username, it returns wrong login, this it's difficult to notice as: - when the password is wrong, it does not re-ask user again (which could be an opportunity to write it again without the space) - the message is: `Password for admin ` so not easy to spot it We prevent extra spaces by setting strip on the login field, but I propose to trim or strip the login user also on the clients.