Password reset endpoint is not brute force protected