CVE-2022-0777: Rate limit missing in microweber

The vulnerability stems from missing rate limiting on password reset endpoints. The patch adds 'throttle:3,1' middleware to both web and API routes pointing to UserForgotPasswordController@send. Before the fix, these routes lacked any request throttling, making them vulnerable to password reset email spam and account enumeration attacks. The controller method itself isn't inherently vulnerable, but the absence of rate-limiting middleware in the route definitions created the weakness (CWE-640). High confidence as the commit directly addresses these routes by adding throttling.