I feel it necessary to ask the obvious -- were you actually able to authenticate as a disabled user or were you just looking through code?
I feel it necessary to ask the obvious -- were you actually able to authenticate as a disabled user or were you just looking through code?