Add rate limiting for bad passwords