require a password reset when too many failed password attempts are made - issue #2656