Start with a random username to test 401 codes

SeeRM #7991

While this fixes the specific case of tomcat_mgr_login, it doesn't
address the general case where modules are attempting to test code 401
responses in order to determine if bruteforcing should continue.
Land #1881, @todb's fix for Redmine Bug 7991