Ideally you should not be able to determine whether a username is valid without authenticating.