Count failed logins, reset on success
Block users with too many failed logins
Make it possible to unblock an account by visiting /unblock?token=x
Fix some faulty logic in the unblocking
Start work on sending email with unblock-token