I was thinking here about CSRF login attacks, where attacker logs the victim into **attackers** account.

This is yet another issue, we will need to utilize ```ezuser_setting.max_login``` in the same way legacy does.