Port NPE fix from trunk Fixes information disclosure (user enumeration) vulnerability. This fixes CVE-2009-580
Changed paths: