Add support for account lockout (fix #58)

This adds the feature described in #58.
Please move `10` to a config parameter so we can adjust in prod w/o a redeploy.