/auth/register should have the option to mask response to prevent existing users from being discovered

[oliver-zhou]

If for example, I'm using email addresses as the Username, I wouldn't want the system to respond that "A user with that username already exists.". It's the same problem that PASSWORD_RESET_SHOW_EMAIL_NOT_FOUND is trying to solve

Created a version controlling the response and email behavior in this situation - need to add some tests before creating a pull request.

[pszpetkowski]

I wouldn't want the system to respond that "A user with that username already exists."

Could you provide some background on the issue? Is it security or something else?

[oliver-zhou]

For security : for those with Username == Email, we should give the developer the option to hide from the user that "Username is not found"