Add failing test (security problem!) regarding username lookup
Add failing test (security problem!) regarding username lookup

If a client requests authentication with a good password (but not a good
username), authentication should *not* be successful.

gevorg/http-auth,sisou/http-auth,http-auth/http-auth,Financial-Times/http-auth