Challenge 2 / 2

We disabled Picard in the database while he was browsing, and he carried right on. Why didn't the UserChecker from the last chapter stop him?

His session cached the old disabledAt, so isEnabled() still returned true.

It only runs for form logins, not for requests authenticated from the session.

A user checker only runs during authentication - nothing consults it on later requests.

checkPreAuth() did run, but exceptions it throws are ignored outside of login.