Don't allow migration endpoint to be used for dictionary attacks