user: add basic protection against brute force (no captcha)