Leaky Database

[Andersama]

If someone were to probe the /forgot-password route they can get feedback which emails exist in the database without a throttle limiting the request.

Like the /signup route there's a check against the ip address making the request. However ideally following /forgot-password through always results in landing on /forgot-password/verify-email as opposed to being redirected elsewhere because the "session" should be poisoned to never accept a code.

[Andersama]

	const clientIP = request.headers.get("X-Forwarded-For");
	if (clientIP !== null && !ipBucket.check(clientIP, 1)) {
        console.log(clientIP);
        count = 1;
	} else {
	// We also don't have to assume "X-Forwarded-For" is filled out.
		const cliAddr = event.getClientAddress();
        console.log(cliAddr);
		if (cliAddr !== null && !ipBucket.check(cliAddr, 1)) {
            count = 1;
		}
	}