I don't think the idea is to indicate whether or not the username is correct. No matter what the user enters for the username, when you spit back "username or p

I don't think the idea is to indicate whether or not the username is correct. No matter what the user enters for the username, when you spit back "username or password incorrect," fill the username with what they typed. A brute force attacker gets no more information than he would with an empty username field because what comes out is identically what he put in, but a real user who mistyped his password knows this immediately by checking the username field and verifying it's correct.