Observable Discrepancy (Information Exposure)

piccolo is vulnerable to Observable Discrepancy (Information Exposure). The vulnerability is caused by a defect in the BaseUser.login function which fails to return responses in a constant time but based on internal state of the application. (e.g: a response is generated immediately when user is not found as against a time expensive hash comparison when a user is found). This discrepancy allows a malicious user to time requests made in order to generate a list of valid usernames for usage in further attacks like password spray.