This results in a data leak. If we return a 404 for an invalid user ID and a different error for a valid user ID, Jumpgate can be used to verify an account's existence as part of a general attack strategy. All authentication failures should be returned with a consistent error.