Module leaks information about existence of user

Hi,

with the module installed it is easy to find out if a user name is valid, which can be problematic.
The attached patch fixes this.

Any user name is accepted and if the user exists and has a question set, it is displayed.
If the user name does not exist (or no question is set for the user), a checksum over the user name is calculated and a question from the pool is selected for display.
The checksum prevents different questions being displayed on successive tries (which would also indicate to the attacker that the user does not exist).