Throttle username logins

I think this PR isn't ready for reviews yet.