added username enumeration and account brute-forcing