Secondary Passwords can be bruteforced (SVE-322-2019-1)

Currently this module doesn't prevent bruteforcing the authentication process.

Maybe this should be moved to sequry/core so that sequry ensures no authentication factor can be bruteforced.