Hook into wp_authenticate instead of wp_authenticate_user. Reason for that - wp_authenticate get called before authentication takes place, while wp_authenticate_user happens after. This help avoid some types of DDoS attacks on login form.
Merge branch 'master' of https://github.com/hashcash/wordpress-hashcash