I understand the ease of guessing out passwords. User names are guessed in a flash. So with what you say, the conclusion must be that two fields are not so secure anyway. Maybe a control on the uniqueness of the Password field in either case should be mandatory.
John Harriss