_handleFailedLoginAttempt() {
    return this._initFailedLoginCount()
      .then(() => {
        return this._incrementFailedLoginCount();
      })
      .then(() => {
        return this._setLockoutExpiration();
      });
  }
set and/or increment _failed_login_count
if _failed_login_count > threshold
  set the _account_lockout_expires_at to current_time + accountPolicy.duration
else
  do nothing