Minor Description
Pasting here the improvement request: "If the server response is different for existing and not existing usernames, the attacker is able to enumerate valid usernames with guessing attacks. He is thereby able to focus his password guessing attacks to the existing accounts."
The fix for this particular issue seems trivial, at the cost of making the login operation slower in the case the user doesn't actually exist.