Secured with bcrypt + CSRF + rate limiting