Tagged rate-limit

Seconds to wait from an HTTP Retry-After header (delay-seconds or an HTTP date), or null if missing or malformed.

Allow a login attempt or lock the account out, from its recent failed attempts, with the seconds until it may retry.