Missing brute force protection on password confirmation modal