Rorking on user managment.

- locked users cannot log in.
- users can request a password reset.
- client handles invalid logon attempts now.