Count a wrong current password toward the login lockout

A wrong current password in update_password now counts toward the same lockout as failed logins, which closes a path to unlimited guessing from a stolen session.