[web2py] Re: Admin security: https vs localhost

[Ross Peoples]

After so many attempts, admin should block the IP address attempting to gain 
access. Further, an invalid password, should require a 5 second timeout. 
After maybe 5 attempts, block the IP. The DenyHosts script that is used to 
prevent SSH brute force attacks does the same thing basically.