> Please please please -- let's drop (at least for now) the "invalid nonce... hash is not"?
> I do see them in regular use and I know that it happens only once a day or so,

I've dropped the ones I couldn't (due to time) generate a test cases for. Regular or not they are still auth failures.

> but fixing up later on is more "expensive" than just not catching some quite rare malicious attempts.

not following. Thought the filters for the rare attempts where what you're asking to fix later. Not sure what the expense is either.

> just other thought aloud: collecting so many failregex'es into one filter might also be quite aggressive to users' human-errors if a single unsuccessful attempt possibly resulting in few associated error messages would get logged... I haven't analyzed them for possible co-occurrence but I guess some could come together?

As I was going through it I didn't see a combination of likely human errors here.

Happy to merge this now?