fix timing attack that could be used to brute force find all user names