There's no data leak. It's a 404 if either the user does not actually exist or you don't have access to view the user. Both result in a SoftLayer_Exception_ObjectNotFound error. All other types of errors (unauthed, server error, etc) are re-raised by the raise statement below.