Summary

In servlet applications, if a user account is disabled, locked or expired, then the user is not permitted to log in.
In reactive applications, the user is still permitted to log in regardless of their account status.

The reactive applications should behave like the servlet application by default, and prevent disabled, locked or expired accounts from logging in.