Display Lockout Error to User (#11135)

api4/user.go

@@ -1240,7 +1240,7 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func login(c *Context, w http.ResponseWriter, r *http.Request) {
-	// Translate all login errors to generic. MFA error being an exception, since it's required for the login flow itself
+	// Mask all sensitive errors, with the exception of the following
 	defer func() {
 		if c.Err == nil {
 			return
@@ -1254,6 +1254,7 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
 			"api.user.login.client_side_cert.certificate.app_error",
 			"api.user.login.inactive.app_error",
 			"api.user.login.not_verified.app_error",
+			"api.user.check_user_login_attempts.too_many.app_error",
 		}
 
 		maskError := true