[security] prevent brute-force attack by waiting after each failed connection attempt

[clochix]

Whatever the method (login screen, API request…), if wrong credentials are submitted, we should wait a little before answering, and before allowing another try.

[frankrousseau]

Bcrypt encryption makes password checking slow. So it already prevents a little bit from brute force attack.