#authentication

Never spread a database row into a sign-in response

One spread operator was enough to hand every client the password reset token hash and the last login IP. The fix is small, and so is the lesson.