add fail_count to User which is needed by brute-force prevention