server: overhaul multiple logins attempts

Currently, entering a wrong pwd more than N times locks the account for a certain time. We need a more flexible solution that could handle a burst of attempts without necessarily locking the account.