Fix timing attack on login form (#39)
Fix timing attack on login form (#39)

As detailed in #357 the time it takes to process a login request is
considerably less if the user specified doesn't exist than if the
password is incorrect. This can be used as a user enumeration attack,
even if the login error messages were customized to avoid this.

I fixed it by increasing the response time of a non-existing user
request by hashing the given password anyway (if using good
password hashing algorithm this is what takes a relatively
large amount of time and makes the attack possibly).

closes #357
inveniosoftware/flask-security-fork,inveniosoftware/flask-security-fork,inveniosoftware/flask-security-fork