User objects keep track of how many times someone has tried to login
unsuccessfully and locks the User after three attempts.