Throttle failed login attempts.

Each failed attempt gets recorded and penalized by a delay of the
square of the previous failed attempts in milliseconds. This will be
unnoticeable for legitimate failures but quickly adds up for guessing
attackers; a hundred failed attempts adds a ten-second delay.

A successful login clears the failed attempts.