User enumeration at login

[AlMaVizca]

How do you see the idea of unify the messages USER_DOES_NOT_EXIST and INVALID_PASSWORD?

If they are split or in a different position somebody could do a User Enumeration.

Testing for User Enumeration and Guessable User Account

[jirikuncar]

@krahser one can change the messages to be equal so the immediate thread is eliminated.

[AlMaVizca]

IMHO it's not just the message, it's also the position in the DOM where the message is rendered.

[jirikuncar]

@krahser then we should change the field validator to form validator.