Added ability to discourage brute force login attacks

Added new options
 
`limitAttempts` when true, too frequent login attempts are ignored and login failures are penalized

`interval` sets the minimum time in milliseconds between login attempts. This value is also used as the base value to calculate failure penalties. Defaults to 100 ms.

`attemptsField` the schema field use to record the number of login failures since the last successful login, Defaults to 'attempts'.

`lastLoginField` the schema field in which to record the timestampt of the last login attempt. Defaults to 'last'.

logins will be penalized by `interval` raised to the power of the number of login failures.

For instance, if `interval` is 100ms, then after

- 0 failures, the next login won't be accepted for 100 ms.
- 1 failure, the next login won't be accepted for 10 seconds.
- 2 failures, the next login won't be accepted for 16.7 minutes
- 3 failures, the next login won't be accepted for 27.7 hours