Inform the user of attempts left

[djay]

but do so in such as way as not to let the user know if its a valid userid or not

• [ ] switch back to status message since redirect doesn't work on 6
• [ ] add in warnings
• [ ] maybe put delay between each attempt?
• [ ] maybe put JS countdown until next attempt