>> Should I be setting a session variable in some way?
yes,
p_web.SSV('tries',p_web.GSV('tries')+1)
but of course this is only "tries this session". If they close the browser, and start again they'll get a new session, and hence 3 more tries.
If you want to count the tries across sessions then you'll need to add a field to your users table. But then you'll need some manual, or timed, reset so that a locked user can be unlocked.
Cheers
Bruce