You might want to disable username based login. It's what we do. Otherwise random jerks can look at the pool list and lock all the non-anonymous accounts.