title: Limiting user login attempts in PHP
body: <p>I've seen web apps with limitations for user login attempts.</p>
  
  <p>Is it a security necessity and, if so,  why?  </p>
  
  <p>For example:  <em>you had three failed login attempts, let's try again in 10 minutes!!</em>  </p>