Security: hashed passwords, CSRF protection, session hardening, and basic rate limiting are enabled.