Lock accounts based on IP & Username

closes #3545
- Repeated login tries by one user are only counted once, keeping a
single user from locking out a whole IP range (implementation according
to @sebgie).