Stronger credential stuffing protection for 1.2 release series

[liamwhite]

• Blocks user login if the provided password is valid for the account and found in a compromised breach
  • Redirects to the password reset and invalidates all existing user sessions/TOTP to log the user out everywhere
• Places hCaptcha on the login form to slow stuffing attacks
• Disables Pwned Passwords checks in development because the default seeded password philomena123 is in the database and it prevents logins
• Dependency updates for the next 1.2 series release