Use the `last_attempt_warning` configuration with the lockable unauthenticated_message message.

This configuration was added in #2687 but it was never used in the real code that
defines what message should be used by the app.

Fixes #3232.
Adding this method as a model config shouldn't expose it as an instance level method to be used in the `unauthenticated_message` method? I tried using but it was getting `NameError`s - also most of the lockable model configuration is only used in the class level setting, not in the instance level.