What I do is put up a warning when
- the username or password is incorrect and
- the username or password provided was all upper-case.
It's a pretty bad idea to only allow smaller letters. You're cutting down the number of possible passwords by a tremendous amount by doing that.