Add optional feature to lock out accounts after N failed login attempts. Lockouts will last M seconds.

add DB migration and fix earlier mistakes in student migration history

add tests and fix bugs that came out of those unit tests

remove unused import

pep8/pylint

address some PR feedback