please review ticket #183 - passwordMaxFailure should lockout password one sooner - and should be configurable to avoid regressions