Lock after X tries doesn't block user authentication

[fredsdc]

I tried wrong passwords until my user was blocked. After that, I entered the correct password and was authenticated as if I wasn't blocked. It seems Redmine still tries to authenticate the user instead of blocking him from any attempt during the timeout.