add ignores
Only verify the first 4096 characters of a password to prevent
denial-of-service attacks through repeated submission of large
passwords, tying up server resources in the expensive computation
of the corresponding hashes.