Protected by 3-attempt persistent rate limiting and secure session hashing.