Constant CREDENTIAL_REJECTION_WINDOW_SECS 

const CREDENTIAL_REJECTION_WINDOW_SECS: i64 = _; // 3_600i64

Within this much of the past, one rejected credential is enough.