This is correct... it's to keep people from trying to authenticate over and over. Linux's login has similar functionality.