Enterprise authentication service with session-based auth, account lockout, and security event logging