This is to mitigate misuse, for example to mass-probe which usernames
are in use.

Changelog: security