Added basic support for limiting bruteforcing

The type of event is now logged as well, which means we can limit the
number of times people fail to log in.

As it is now, 10 failed attempts in a 30 minute window will cause a
lockout.

This starts implementing the requirements of issue #283.