Table for noting failed logins per user with timestamp.
Add a check for login failure threshold being  met to User model.
Fail login if user or session failure thresholds met.
Randomised field name for login / forgotpw username fields.

This effectively acts as a CSRF token.
Send same confirmation message for all forgotpw requests.

This is to prevent username enumeration.
Limits on password reset.

5 per session.
Only mail a user again 5 mins after last request.
Change the session ID on successful login.
Config is for session, not state plugin
Merge pull request #274 from duckduckgo/login-rate

Login rate