Add throttle to authed password routes

[valorin]

Following up from #157, fair point that the non-authenticated routes in that PR would throttle via IP, which makes them a risk. The Confirm Password and Password Change routes, on the other hand, are both authenticated so the throttle will work based on the User Identifier instead.

Rate limiting these routes is important because they are vulnerable to brute-force attacks if a user's session is hijacked. An attacker who gains access to a user account, can brute-force the user's password to bypass the verification step, or change the password entirely. This would bypass any brute-force monitoring or protections present on the login form.

The risk is relatively low, as an attacker would need to have hijacked the user's account, but it's still a weakness that should be patched.