Update spam prevention

closes #3468
- added rate limit to deny more than 5 attempt every hour
- updated spam prevention to be configurable
- added config values spamTimeout, ratePeriod, rateAttempts
- added ratePeriode:1 to config.example.js to prevent functional tests
from hitting the rate limit