No need to allow custom headers for something this simple
Include a user-agent string in brute force requests for good measure
Bump version to 0.1.1