Element polls /register to see whether your email verification link has been clicked or not. Apparently we submit the password every time we do so, and /register hashes that with bcrypt every time, meaning you can easily use >100% CPU with people just trying to sign up. Surely we should not re-hash every time, and/or not submit a password every time, given we're just polling to check if the link has been clicked...