jliew
committed
on 25 Sep 07
move user disabled check after authentication, to give non-db methods a chance to update disabled flag.