Information Disclosure on rate limit defense mechanism

Summary

Security researcher showed that we were returning the number of seconds to wait between attempts. While this can be helpful for legitimate users, it's more likely to be exploited by attackers that simply need to set a timer for the number of seconds we return in the error message.