In true dansup fashion, I overengineered the Loops Invites feature.
So, to prevent enumeration, we require a captcha before validating the invite key (if you have captchas enabled, which you should)
Then we verify the invite key securely (preventing timing attacks) after a 3-5 second delay, and rate limit requests by IP.
Then we create a session token which is used in subsequent requests (like username availability/age gate)
And expires in 15 minutes.
There is more, but that's the gist π
