Protected by rate limiting and optional two-factor authentication.