By the way, while we are on this topic--can you confirm that passwords are not stored in plain-text?
(def good-login (user pw ip)
(let record (list (seconds) ip user pw)
(if (and user pw (aand (shash pw) (is it (hpasswords* user))))
(do (unless (user->cookie* user) (cook-user user))
(enq-limit record good-logins*)
user)
(do (enq-limit record bad-logins*)
nil))))
...
(let record (list (seconds) ip user)
...