all of these settings should be configurable

- timeout-account: a specified timeout for which to disable logins for an account (after x failed attempts for a single account)
- timeout-ip: a specified timeout for which to disable logins for an ip address (after x failed attempts from the ip address within time-range)
- captcha-account: the same as timeout-account, only logins will still be possible when an additional captcha is solved
- captcha-ip: the same as timeout-ip, only logins will still be possible when an additional captcha is solved