Lab - Broken brute-force protection, multiple credentials per request

Normal login returned a 200 status code:

We supplied the password list as an array and observed a 302 redirect when a valid password was used:

---