TryGhost/Ghost — pull request #2082 by sebgie (2014-01-30 10:17:30+00:00)
Title: Add security to password reset token

no issue
- added check that a combination of email + expires is rejected after
10 attempts
- changed comparison to time independent method

Thanks to @chiiph for reporting this issue!