Block user accounts if an incorrect password was entered 5 times

[evert]

We should have an 'incorrect password' counter per user. If this exceeds a (hardcoded, for now) number we should prevent future attempts to log in.

A successful login should also reset this counter.

This implies that we need a new property in the database on a user, indicating that too many incorrect login attempts were made. This property can just be the number of previous attempts.

Make sure that when this condition happens, the user sees an error like:

"Too many failed login attempts, please contact [admin] to unlock your account"