[TECHNICAL-SUPPORT] LPS-37461 Unsuccessful login leaves user vulnerable to replay attack

Hi Ray,

Tomás advised to send the security issues for review to you or Sam as long as he's on holiday.

This is a fixed version of my former PR to him (https://github.com/topolik/liferay-portal/pull/43).
After rethinking and retesting the solution, I didn't experience undesirable side effects (like this one: https://github.com/topolik/liferay-portal/pull/43#issuecomment-20657037).

Thanks for reviewing!

Cheers,
László