Of course, thanks. Guess I wrote that without actually thinking about it. Now, a pepper would prevent brute forcing weak passwords, assuming it wasn't compromi

Of course, thanks. Guess I wrote that without actually thinking about it. Now, a pepper would prevent brute forcing weak passwords, assuming it wasn't compromised, but that's not relevant here. And regardless I agree with your logic regarding forcing a reset.