fixed user enumeration and hide password chars when registering
merged master with userEnum