Implement rate limiting policy.

First policy is to only allow N failed logins per calendar month.
This is said to be an imminent Kantara requirement.

Also, add ordering of credential validation based on last successful
authentication.