IA Page - merge ia/view with ia/edit
IA Pages - remove the cancel button
Table for noting failed logins per user with timestamp.
Add a check for login failure threshold being  met to User model.
Fail login if user or session failure thresholds met.
Randomised field name for login / forgotpw username fields.

This effectively acts as a CSRF token.
Send same confirmation message for all forgotpw requests.

This is to prevent username enumeration.
Limits on password reset.

5 per session.
Only mail a user again 5 mins after last request.
Change the session ID on successful login.
InstantAnswer.pm - replace try-catch block with conditional block
InstantAnswer.pm - don't redirect to JSON pages after login
Config is for session, not state plugin
Merge pull request #273 from duckduckgo/merge-view-edit

IA Page - merge ia/view/<id> with ia/edit/<id>
Merge pull request #274 from duckduckgo/login-rate

Login rate