So, as per the author, sites should first check if the user exists and then check the password? Why? What if the username belongs to someone else?