bastodon/app/controllers/concerns/auth
..
captcha_concern.rb
registration_spam_concern.rb
two_factor_authentication_concern.rb