Prevent brute-force attacks against authorization

[JumpyLionnn]

Make sure login endpoints are protected to make private data more secure.
A simple and powerful technique is to block authorization attempts using two metrics:

1. The first is number of consecutive failed attempts by the same user name and IP address.
2. The second is number of failed attempts from an IP address over some long period of time. For example, block an IP address if it
   makes 100 failed attempts in one day.

rate-limiter-flexible package provides tools to make this technique easy and fast.
there is also the ratelimiter package that can help with that as well as the express-rate-limit package.