Fix: check user pass only if user exists

handlers/auth.go

@@ -92,12 +92,13 @@ func HandleFrontLogin(w http.ResponseWriter, r *http.Request) {
 		log.Debug("making new player", "error", err, "state", userstate)
 		userstate = models.InitPlayer(cleanName)
 		makeplayer = true
-	}
+	} else {
 		if userstate.Password != clearPass {
 			log.Error("wrong password", "username", cleanName, "password", clearPass)
 			abortWithError(w, "wrong password")
 			return
 		}
+	}
 	http.SetCookie(w, cookie)
 	fi := &models.FullInfo{
 		State: userstate,