Mitigate brute force attacks on login page

[eluser]PhilTem[/eluser]
In case you add the sleep command to your code, the server isn't released from work since it's only sleeping and still processing the PHP interpreter's actions - which, in fact, is waiting. So there's still load on your server. It's really better to block IPs after too many wrong credentials.

Blocking IPs is really easy, since you already have a controller for the login page. Just add a check for any rows in your failed-logins-table where the IP matches and the record is not older than, let's say, 24h. If you find no rows the login form may be displayed, otherwise simply redirect to some other page of your desire.