Add support for account lockout (fix #58)

This adds the feature described in #58.
Indeed, it's gross. There's already a follow-up bug for it: https://github.com/mozilla/fxa-customs-server/issues/40