Also, have some concerns about this function in general. If it doesn't find a username, it will return None, and register_authentication_attempt will then use that in the key for the counter. I think that error case has to be handled somehow.

Why are we looking for "username" in a JSON request body? That seems like a pretty big assumption that we don't document anywhere.