require a password reset when too many failed password attempts are made...

... - issue #2656 

Even though there's zero UI change, I claim this is ready for merge