Hash the password for an unknown username at login.

An unknown username got a fast answer, which showed which usernames exist.

session.lib.php

@@ -211,6 +211,21 @@ function password_hash_is_stored($username, $hash) {
   return $row && $row['password'] === $hash;
 }
 
+/*
+ * TRUE if $password matches $stored_hash. For an unknown editor
+ * ($stored_hash is NULL), it hashes the password anyway, so that the
+ * answer takes as long as for a wrong password, and does not show which
+ * usernames exist.
+ */
+function editor_password_valid($password, $stored_hash) {
+  if ($stored_hash === NULL) {
+    password_hash($password, password_algorithm());
+    return FALSE;
+  }
+  // password_verify() also accepts hashes made by the old crypt() call
+  return password_verify($password, $stored_hash);
+}
+
 /*
  * After a successful login, move an old hash (MD5-crypt, bcrypt) to the
  * current algorithm. If the column is too short and MySQL cut the new