Username enumeration via unequal login processing

A timing discrepancy in the vantage6 server before 4.2.0 allows remote attackers to determine whether submitted usernames exist. The user_login function checked username existence before password verification, so nonexistent accounts skipped the password-hash work applied to valid accounts. No authentication or user interaction is required; repeated timing measurements disclose account names that can support credential attacks.