Defending against password spray attacks