REST behavior of permanent and temporary locking during authentication