Credentials come from STUDIO_AUTH_USERS. Three failed attempts lock the account; each further failure lengthens the lock.