. . . "An automatic tester may be configured to send incorrect data for either the username or the password (or both), but cannot determine whether the error message is a result of the incorrect data transmitted, or of incorrect data handling at the server." .