Comment by b800h

What is infuriating about this is that this should be a solved optimisation problem, but it has probably been outsourced on the cheap to some bog-standard web dev team who have tried to figure it out from first principles. It's a bit like trying to roll your own security.