Rate limit login attempts and miscellaneous changes

The rate limiting code was lifted from the mvc version and worked just fine in my testing. Please let me know if everything is ok in this patch. Thanks.