Favor Devise paranoid mode

[eliotsykes]

  # It will change confirmation, password recovery and other workflows
  # to behave the same regardless if the e-mail provided was right or wrong.
  # Does not affect registerable.
  config.paranoid = true

Does Clearance have a similar option to mention?

[tute]

cc @derekprior for context user enumeration type of attacks and Clearance. Thank you!

[derekprior]

This is how Clearance works by default. You can still enumerate used email addresses in registration though as you'll get a message about the email address being in use. I think this is similar to devise.

[eliotsykes]

Thanks @tute & @derekprior. Great to discover Clearance works like this by default. (Devise requires opt-in to paranoid mode.)

I'll add something to the checklist about both shortly.

(for reference Devise.paranoid defaulting to false https://github.com/plataformatec/devise/blob/f7b6d786066cef2f5e8d2ce9c6b6cc83918580eb/lib/devise.rb#L281-L283)

[eliotsykes]

PR #26 opened to cover this. Leaving it open for a day or two for feedback.