Replace "will" with "may", since things are not always logged, only if log level is set to debug.
Adding LoginAttempt model and removing lastLoginAttempt from User
Rewriting auth.verify()

Adding:

1. better anti-DoS and anti-bruteforce protection
2. a bit of timing attack mitigation on valid usernames