Added extra password question (rate-limiting)