Add optional feature to lock out accounts after N failed login attempts. Lockouts will last M seconds.

add DB migration and fix earlier mistakes in student migration history

add tests and fix bugs that came out of those unit tests

remove unused import

pep8/pylint

address some PR feedback

fix tests

fix broken test

try to mock time

use freeze-gun to overload the system time to simulate the future