CVE-2022-2651: Email Verification Bypass Leads To Account Takeover in bookwyrm

1. Hello maintainer, i noticed that there is no ratelimit protetcion on https://book.dansmonorage.blue/confirm-email endpoint, so we can perform bruteforce attack

Steps to reproduce:

1. Create a acount with victims email id
2. When the account is created, its ask for email confirmation via validating OTP on https://book.dansmonorage.blue/confirm-email
3. Enter any random OTP and try to perfrom bruteforce attack

Patch recommendation:

1. Add ratelimit protecion on POST confirmation email endpoints/parameters

Impact

1. Pre-Account Takeover