add password enumeration protection