add PasswordChangeLog
add rate-limit
use DNS SRV records to find the AD server
add missing csrf_token stuff