Separate authentication strike (excessive login attempts) count from timeout
enforcement.