Well... it did this again. I reset my password, which made my current password invalid, and now I'm stuck again. You should find a way to loosen it up a bit-maybe after they get the login right, forget the past attempts. It would still protect against brute-force attackers fine, unless their password is super easy to guess-then that's their problem.