Prevent brute force attacks on login request handler #903

This question came up in #893 (comment) (which is already merged).

The gist is: /lib/requests/create-account-request.js#L128 currently has no way to guard against brute force attacks.

OWASP gives some tips on how to block them. Fail2ban is popular among Sys Admins, too.

Plus, it could be an information leakage, but @megoth and @dmitrizagidulin argued, that the information would be public anyway.