title: How many failed login attempts should you allow - and in what period of time?
body: <p>In order to protect against brute force attacks on the login system, how many failed login attempts should you allow - and in what period of time?</p>
  
  <p>What does it mean to "lock the account" - simply not allowing them to log in (even with a good password)?</p>