Sessions are stored server-side and can be revoked. Five failed attempts locks this address out for 15 minutes.