check count of login attempts,
not allow to login with old password if user try to change through forgot password
add field in settings for storing limit of login attempts