10 invalid login attempts should lock the account
email confirmation needed to unlock