Describe the bug

Currently, login requests will fail faster if the user does not exist as the hash does not have to be computed. This can leave to timing attacks where an attacker can guess if a user exists or not, which defeats account enumeration defenses.

Expected behavior

Every login request should take a similar amount of time regardless of whether the user exists or not. The

In order to make the email functionality work on my SMTP server (which forwards emails to a secure ISP relay), I had to make these changes in the userfrosting/app/sprinkles/core/config/default.php:

'port' => 25,
'auth' => false,
'secure' => 'false'

Please consider adding these options to the setup options (and documentation).
I had to create a PHPMailer application to debug my