[authentication] account locked handling #31

also related to : security bug!! after 5 login failures, account locked
but user is logged in !! #29
support isREST flag

security bug!! after 5 login failures, account locked but user is logged
in !! #29
and
https://github.com/OhadR/oAuth2-sample/issues/43