throttle log in attempts per IP

[josh-griffin]

reduce the number of log ins a certain IP can do within a time frame

[josh-griffin]

this is done per user, I dunno if we also want to do it per ip

[mark-prins]

slightly reluctant - the main issue is blocking failed login attempts to reduce brute force attacks; restricting by IP is trying to fix the same problem, I think - but with the potential to cause problems for large organisations using a proxy server or firewall.

I'd like to do a little research before charging ahead with this one