SECURITY: Limit passwords to 200 characters

Prevents layer 8 attack.

app/controllers/session_controller.rb

@@ -54,6 +54,8 @@ class SessionController < ApplicationController
     params.require(:login)
     params.require(:password)
 
+    return invalid_credentials if params[:password].length > User.max_password_length
+
     login = params[:login].strip
     login = login[1..-1] if login[0] == "@"