Line 540 of DiffusionController.php is:
```
$user = id(new PhabricatorPeopleQuery())
>>> ->setViewer(new PhabricatorUser())
->withUsernames(array($username))
->executeOne();
if (!$user) {
// Username doesn't match anything.
return null;
}
```
This should be:
```
$user = id(new PhabricatorPeopleQuery())
>>> ->setViewer(PhabricatorUser::getOmnipotentUser())
->withUsernames(array($username))
->executeOne();
if (!$user) {
// Username doesn't match anything.
return null;
}
```
Otherwise if the default, anonymous user can't search for the user list, then the authentication will always fail.