b3e262187c
OneTimeTokenAuthenticationProvider no longer validates account status by default. Applications can opt in via setUserDetailsChecker, for example by providing AccountStatusUserDetailsChecker to reject locked, disabled, or expired accounts. Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>