User is never locked out on failed login attempts

[Neutrino-Sunset]

No matter how many times the user enters the wrong password they are never locked out.

This is true irrespective of whether you set MaxFailedAccessAttempts or not.

The Piranha_Users.AccessFailedCount entry in the database is never updated. Manually setting it to a value greater than MaxFailedAccessAttempts also has no effect.

Either this is a bug, or this documentation is wrong, or I'm doing something wrong. But I've just tested this using your own project template and it looks broken to me.

[Neutrino-Sunset]

Also since POST /manager/login returns 200 on failed login I can't set up a monitor on the web server to detect 401 errors and raise an alert for brute force authentication attacks. Which since the user is never locked out on multiple failed login attampts is a major problem.