Prevent brute-force attacks during authentication

To prevent brute-force attacks the account model enforces a maximum
number of failed login attempts which is performed during
authentication. When the limit is reached an account is locked,
and later unlocked after a period of time has passed.