add brute force protection to password reset to make it harder to guess user logins

Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>

core/Controller/LostController.php

@@ -202,6 +202,7 @@ class LostController extends Controller {
 
 	/**
 	 * @PublicPage
+	 * @BruteForceProtection passwordResetEmail
 	 *
 	 * @param string $user
 	 * @return array