Login security rule: after 5 invalid attempts, the account is temporarily locked for 15 minutes.