Messy login logic mixing lockout policy, clock handling, token generation, mutation, logging, and file I/O.
