Bern, with the rate limit mechanism in place,
do you think this can be closed?

You suggested a textcaptcha after so many failed attempt
or logging all failed attempts and notifying the user.
That would require a different framework and also allows the
attacker to eat more resources than the rate limit solution does.

I have a couple more changes to make to rate limit: setting the
config value to 0 disables the rate limiting code, change
config to verify that integer value is not negative.

Also password migration/upgrade test is now passing (technically
xpassing). The xfail marker has been removed.

I have no clue what fixed this.

-- rouilj