Fixes #140

@ruKurz Before this fix, the information about being disabled was intentionally hidden from the user.
I guess this could have been done intentionally so that blocked users don't know they are blocked.

Now, this information is propagated and presented to the user.
As you can see, the fix is minor. There is no semantical difference in the accounts validation callback whether false is returned or an exception is thrown:

/**
     * Validate login attempts.
     *
     * @locus Server
     *
     * @param {function} func - <p>Called whenever a login is attempted (either successful or unsuccessful).  A login can be aborted by returning a falsy value or throwing an exception.</p>
     */
    function validateLoginAttempt(func:Function):any;

In addition to propagating this information on login, I also threw the same error once a disabled user tries to reset his password.