Immediate Lockout after First Failed Attempt Instead of Third Attempt for Login1FA API

Bug description

Using the Login1FA API we are getting an immediate error wherein the User failed to login that account will be automatically locked. 

So, instead of the default of 3 retries, at the first failed login attempt that user is immediately locked.

How to reproduce the issue

1. Using POSTMAN make a POST request using Login1FA supply the username and INCORRECT password of the user.
2. You should be able to see the Account being Locked.

Expected behaviour

After the first failed attempt the user will be able to try for the second and third attempt.

Current behaviour

After the first failed attempt the account of the user is being LOCKED.