BF/ENH: fixed so xarf-login-attack works
DOC: changelog for xarf-login-attack action