Remove information leak about whether a user exists on the system

Now createChallenge will always return a challenge. If there is no key
a dummy Fingerprint is created based on the server secret and username.