Fixes the brute force attack vulnerability in user authentication

Fixes <a href="http://code.google.com/p/otwarchive/issues/detail?id=3856">Issue 3856</a> and <a href="http://code.google.com/p/otwarchive/issues/detail?can=2&q=2580">Issue 2580</a>

<em>Replaces pull request for 2580</em>

Correctly suspends user's accounts on repeated failures (50 times) for 5 minutes, displays the time until suspension upon attempted logins. This fix only applies to the User's authentication sequence. 

Also contains (and relies on) the code from 2580 where a log message is produced when the user has their account suspended. This code is pre-init-safe and should properly continue any suspensions in progress until their natural termination of 5 minutes.