Deny logging in if: * [ ] X total attempts in the last time period for a given source IP address. * [ ] Y failed attempts in the last time period for a given source IP address. Further things: * [ ] Decide if this is tracked via an in-memory data structure or the database. Maybe just support both?
Deny logging in if:
Further things: