I misunderstood how AccessAttempts were created:

Fixed _get_user_attemtps to actually work like I want it to.
Wrote test for ip_whitelist changes.