we should also keep previous (working) regexp in place (and should still be anchored at the end). what about
```
(FAILED login|Login failed) for .* from <HOST>\s*$
```

and add a corresponding test line to ```testcases/files/logs/roundcube-auth```