User login flood control missing

@klausi are you ok with the attached patch?

Looks good here too. The user is blocked by flood control when try to make 5 requests with wrong access data.

+1 RTBC

I noticed a couple of things about the patch in #2: it registers 'failed_login_attempt_user' events but doesn't check for them with flood_is_allowed(), and doesn't clear flood failures on successful login.

The attached patch leans on the validation that the user_login form uses instead, so it registers and checks the same events.

It seems like services doesn't respond well to drupal_access_denied() - it prints the themed Drupal 403 page which screws with the json/xml/whatever response. Not authenticating the user seems to be enough to present a standard services access denied message in the correct format.

(no interdiff as the approach is too different).

Committed.