Username enumeration via nonconstant login response timing

Observable response discrepancy in Piccolo before 0.121.0 allows remote attackers to enumerate valid usernames through login timing. BaseUser.login returns immediately when no user matches but performs an expensive password hash comparison when the username exists, creating a measurable delay. An exposed login portal is required; the flaw reveals account names but does not itself authenticate attackers or alter data.