security: Pwreset Hardening

This mitigates a report submitted by Ruben Ferreira of CSA Cyber in
regards to password reset.

pwreset.php

@@ -15,6 +15,7 @@ if($_POST) {
     }
     switch ($_POST['do']) {
         case 'sendmail':
+            $start = microtime(true);
             $userid = (string) $_POST['userid'];
             if (Validator::is_userid($userid)
                     && ($acct=ClientAccount::lookupByUsername($userid))) {
@@ -34,6 +35,14 @@ if($_POST) {
             else
                 $inc = 'pwreset.sent.php';
 
+            $min = 1.4;
+            $jitter = random_int(0, 250) / 1000;
+            $target = $min + $jitter;
+
+            $elapsed = microtime(true) - $start;
+            if ($elapsed < $target)
+                usleep((int)(($target - $elapsed) * 1_000_000));
+
             break;
         case 'reset':
             $inc = 'pwreset.login.php';