1. Go to stash (eg http://localhost:7990/stash/, redirects to http://localhost:7990/stash/login?next=/projects)
2. Leave either the username or password field blank
3. Click the login button

Expected results: "Invalid username or password." error message
Actual results: Redirected to http://localhost:7990/stash/j_stash_security_check which gives a 404 error page

Logging in with an incorrect username/password (but not blank) does give the expected result error message.

This is with only a local directory, in stash 3.10.0. It works on stash 3.6.1