REST: possible to login with passwordHash of existing user and unexisting username

Pre-conditions:
Register a new or use existing user with next credentials:
username: uniqueuser
passwordHash: 05b248a5bbb810f848cabd27d9a87e56

Steps to reproduce:
1. Make login GET request with username that is not registered and passwordHash of existing user:
username: unique
passwordHash: 05b248a5bbb810f848cabd27d9a87e56
http://qa.jtalks.org/poulpe/rest/authenticate?username=unique&passwordHash=05b248a5bbb810f848cabd27d9a87e56

Actual result: Successful login as "uniqueuser"

Expected result: Login failed