WEB-483 re-introduced specifying lock period
WEB-483 fixed bug where User pk is returned instead of username
WEB-483 updated spec to reflect current lock stuff
WEB-483 completed lock enforcement