Clear the tracked URL if user locks out and use $GLOBALS['TL_CONFIG']['sessionTimeout'] to ignore old url entries when searching users