mod_invites_register_api: Use set_password() for password resets Previously the code relied on the (weird) behaviour of create_user(), which would update the password for a user account if it already existed. This has several issues, and we plan to deprecate this behaviour of create_user(). The larger issue is that this route does not trigger the user-password-changed event, which can be a security problem. For example, it did not disconnect existing user sessions (this occurs in mod_c2s in response to the event). Switching to set_password() is the right thing to do

-- mod_statistics_auth
module:set_global();

local auth_ok, auth_fail = 0, 0

function module.add_host(module)
	module:hook("authentication-success", function(event)
		auth_ok = auth_ok + 1
	end);
	module:hook("authentication-failure", function(event)
		auth_fail = auth_fail + 1
	end);
end

module:provides("statistics", {
	statistics = {
		c2s_auth = {
			get = function ()
				return auth_ok;
			end;
			tostring = tostring;
		};
		c2s_authfail = {
			get = function ()
				return auth_fail;
			end;
			tostring = tostring;
		};
	}
});