Agreed in principle, although I'm not sure 3 seconds is the right limit. I'd be alright with 5 or 10, easily.
agree with 5 - 10 secs
i understand the possibility of a attack or overwhelming the system. but 90 sec is a lifetime. especially if a misspelling occurs. 90 secs makes me reflect on my life choices.