The server SHOULD have a timeout for authentication and disconnect if
the authentication has not been accepted within the timeout period.
The RECOMMENDED timeout period is 10 minutes. Additionally, the
implementation SHOULD limit the number of failed authentication
attempts a client may perform in a single session (the RECOMMENDED
limit is 20 attempts). If the threshold is exceeded, the server
SHOULD disconnect.