New accounts require parent email verification before first login.

After 5 failed attempts, logins are locked for 15 minutes.