* feat: limit the maximum number of concurrent login attempts

* unit test rate limiter

* address reviewer questions