make lockable default

Without the `lockable` module it is possible to do a timing based username enumeration so I propose to make `lockable` opt-out rather than opt-in.