A pleasingly well written paper for the most part.
Was I the only one that over complicated the user login one? :(
I devised it that any number of users could try logging in in any given order.
(Had the functions getUserAttempts() and incrementUserAttempts() and ended up 50~60 lines long)...