fixed user enumeration and hide password chars when registering