HTTP/1.0 and HTTP/1.1 with and without SSL/TLS are supported transparently. Thus, both http and https protocol prefixes can be used successfully throughout a site without limitation ...

Account lockout policy is modelled on policies with a history of great success on internal corporate server systems. If a user enters 5 consecutive incorrect passwords in a row the account will be disabled for a period of time.

Further the lockout period is calculated as 5/t * 3 hours, where t is the time in minutes between the first error and the fifth error. Thus, if the account is under automated attack the lockout duration is increased proportionately to the speed of attack ...