Add support for account lockout (fix #58)

This adds the feature described in #58.
`10 * MAX_BAD_LOGINS` appears twice in this patch. Let's consolidate it into another constant.