[security improvement] User enumeration [#314]