Account-enumeration safe: same response shape on bad email vs bad password.