Lock accounts based on IP & Username

closes #3545
- Adds username as a condition in the rate limiter, thus preventing one
user to lock out a whole range of users with the same IP.