s3:auth: don't update the bad pw count if pw is among last 2 history entries