consider more sophisticated ways of rate limitting login requests

[joshunrau]

see https://security.stackexchange.com/questions/24287/throttling-failed-login-attempts-exponential-timeout-by-ip-using-a-session-co