[DSGVO] 6.2. Security of processing — Art. 32

[thomiel]

Password handling is already bcrypt, but anyway: add login throttling and an inactivity timeout for staff sessions if not present.