[IMPROVED] Lockout user on invalid pin/password

This will lock a user account if a password or PIN has been entered
wrong for multiple times in a row. When unlocking the account via admin
panel, both counters are reset so the user can log in again.

This should fix issues with brute force attacks to access user accounts.

Please see configuration dist file for new config options.
Please import SQL upgrade 007 to add new column to user accounts table.

Addresses #670 and should be merged once tested.