[Auth] Configure Max Allowed Failures

[lonnieezell]

A new auth setting needs to be made: auth.max_failures which is the maximum number of failed attempts that an account may have before it's locked out for a period of time.

Then, in the login process/throttling checks, we need to implement the lockout, very similar to how it's done for lots of failed request in short amount of time.