- removed user get query from DDoS check in
- fixed DDoS protection to update login_attempts if user not exist too
- removed user get query from DDoS/reCAPTCHA check
- fixed DDoS/reCAPTCHA proection to update login_attempts if user not exist too
- added `get_login_attempts()` returns login_attempts as INT (used in `login()`)