Session locks after inactivity.
Failed attempts are logged & account locks after 5 tries.