[mandelbrotwurst]

Is the idea that the attacker is brute forcing the login method and they are less likely to be successful if the input must be passed in an unexpected format?

[d_tr]

Types where the constructor takes care of the rules and aborts if you pass it something stupid (like an empty string for a user name).