Security improvements / GDPR

[Rotzbua]

Hi,

I have checked the grav according to the requirements of the GDPR.

I found that

• the pure IP address is used for brute force protection/rate limiting.
• brute force protection/rate limiting is not enabled by default.

Both should be fixed.

I propose following PRs:

195

196

Best.

[rhukster]

merged.