Login protection

We´ve talked about a feature to prevent login spam.

The whole Idea is:
- Set a Captcha scenario after 5 login attempts
- Set the user inactive with email confirmation after 10 attempts

For now I realized the first step and the login counter, but I have problems with the performance, because of double validation of form data. The counter is stored in session, for now. Later we should implement it in database with IP-check.

Have you any Ideas or suggestions? If you like, fetch my code and we talk about solutions :dancer: