Example in readme is vulnerable to timing attack

[LostKobrakai]

    user = Repo.get_by(User, email: username)

    cond do
      user == nil                            -> {:error, :no_user_found}
      check_pw(user.password_hash, password) -> {:ok, user}
      true                                   -> {:error, :invalid_password}
    end

Even if no user was found the pw should be checked to ensure response timings are consistent for both.

[danschultzer]

Thanks! I've opened #57 that improves the example.