Added account lockout feature with ASP.NET Identity 2.0: default time is 5 minutes after 5 failed login attempts.