Throttling fix & Add protection against login brute forcing

[pglombardo]

Description

This PR fixes #2684 and enables login brute force protections:

• Throttle POST requests to /users/sign_in by email param
• Limit POST requests to /users/sign_in to 5 per 20 seconds

These changes also mean that you can now disable throttling entirely by commenting out the throttling.minute and throttling.second values in settings.yml.

Related Issue

#2684

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Checklist

• I've written tests (if applicable) for all new methods and classes that I created. (rake test)
• I've added documentation as necessary so users can easily use and understand this feature/fix.