extract method #max_login_attempts

Respects Law of Demeter, useful for stubbing out methods on instance or
for apps that use the NullObject pattern for guest user accounts.