Testing for user enumeration (OWASP-AT-002)