lock account after given amount of failed login attempts
new config options for account locking
tests for account locking