server: write max challenge requests into protect log