The login screen should protect the users from a brute force password attack. This can handled by approaches such as:

1) Locking an account out after X many failed attempts.
2) Supporting an escalated delay between logins (first failed login delay 5 seconds, second 10, third 20, etc)