joscha/play-authenticate — pull request #83 by petru-ghita (2013-04-18 22:58:49+00:00)
Title: Update UsernamePasswordAuthProvider.java

In order to avoid exposing the fact that the user has/has not an account, WRONG_PASSWORD and NOT_FOUND should give the same result. It can be argued that if the one that is checking does not have an account he won't know anyway what the difference would be, but then the attacker might just as well have an account.