Add custom token support

internal/server/login.go

@@ -40,7 +40,7 @@ func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
 	next := destination(r.URL.Query().Get("next"))
 
 	// Already logged in: say so rather than showing an empty form.
-	if lim, err := s.limitsFor(cookieCredential(r)); err == nil && !lim.Anonymous() {
+	if lim, err := s.limitsFor(r, cookieCredential(r)); err == nil && !lim.Anonymous() {
 		s.render(w, http.StatusOK, "login.html", loginPage{
 			page:      s.page(r, "Log in", false),
 			Next:      next,
@@ -70,7 +70,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	// Only failures are throttled, so logging in normally is never delayed.
-	lim, err := s.limitsFor(token)
+	lim, err := s.limitsFor(r, token)
 	if err != nil {
 		if !s.authLimiter.allow(clientIP(r, s.cfg), s.now()) {
 			s.loginFailed(w, r, next, http.StatusTooManyRequests,