Block login attempts after 10 failed for half an hour

this replaces sleep() to avoid bruteforce attacks