Challenge 1 / 2

Once expose_security_errors is set to account_status, why did we move the disabled check from checkPreAuth() to checkPostAuth()?

checkPreAuth() runs before the password is verified, so anyone could type any password and learn the account is disabled.

checkPostAuth() is the only one of the two that runs for remember-me logins.

Account status exceptions thrown from checkPreAuth() are always masked as "Invalid credentials."

checkPreAuth() doesn't receive the token, so it can't tell which account is being used.