Make ia_page_version a DDGC member in the Config section.
IA Page - merge ia/view with ia/edit
IA Pages - remove the cancel button
Table for noting failed logins per user with timestamp.
Add a check for login failure threshold being  met to User model.
Fail login if user or session failure thresholds met.
Randomised field name for login / forgotpw username fields.

This effectively acts as a CSRF token.
Send same confirmation message for all forgotpw requests.

This is to prevent username enumeration.
Limits on password reset.

5 per session.
Only mail a user again 5 mins after last request.
Change the session ID on successful login.
InstantAnswer.pm - replace try-catch block with conditional block
InstantAnswer.pm - don't redirect to JSON pages after login
Config is for session, not state plugin
Setting some additional headers for CSP and IE behaviour
Require password to change email address or delete account.
Require action token for submitting content reports
Require action token for changing language options
Merge pull request #273 from duckduckgo/merge-view-edit

IA Page - merge ia/view/<id> with ia/edit/<id>
New paths to set redirect URL in session and perform redirect
Perform redirect, setting window.opener to null.

This will prevent the linked page performing any action on the original
window.