require a password reset when too many failed password attempts are made - issue #2656
fix race conditions in authentication lockout test
add tests for all internal apis to verify that they are not publically accessible via the router
Merge pull request #3337 from mozilla/issue2656

require a password reset when too many failed password attempts are made...