lots of redirect clean up, unit tests for authController, locks user account after 5 bad login attempts. This doesnt work well because its done on the user not the client trying to attempt.