Lock accounts based on IP & Username

closes #3545
- Adds username as a condition in the rate limiter, thus preventing one
user to lock out a whole range of users with the same IP.
- Changed default rate limit to 5 (per @sebgie's comment)