Maxym Borodenko authored Feb 12, 2018 and Matija Obreza committed Feb 12, 2018

- set the principal in the security context
- Refuse password reset request for locked and disabled accounts