[forkger]

Docs for kmworks/kmrs#394, in the behavior differences on the enhancements page:

• API, sessions, and settings: stored sessions are bounded, 50 per user in sessions.sqlite (least recently used dropped) and 10,000 in total for the in-memory store, where Java keeps every session until it expires.
• Security and authentication: the activity throttle line now covers successful password authentications too, one row per user and device per hour, with sign-ins from another device and failures still recorded right away.