Too many requests stay generic

After three asks in an hour the API still returns the same copy.

RESET_MAX_PER_HOUR is 3. Extra POSTs still return the generic message. They do not reveal whether the address exists.

Rate limit on auth-forgot is 5 per 15 minutes in addition to the hourly cap.