Rate limit the login endpoint

[kuboschek]

Currently there is no limit to the number of login requests.

A solution to this issue limits login attempts within a certain time window by both user and IP.

[tkw1536]

We should take the proxying done by almost any deployment technique into account. In practice we will need to trust

X-FORWARDED-FOR

headers.