Password can be bruteforced (SVE-622-2019-1)

Currently this module doesn't prevent bruteforcing the authentication process.

Maybe this issue should be moved to sequry/core so that sequry ensures no authentication factor can be bruteforced.