Credential stuffing protection

Blocks most of a credential-stuffing bot burst before it reaches login.

Prerequisites#

Research these first: Rate limiting.