TokenAuthenticator should check `canLogIn` before actually logging in a user

[bummzack]

Member::canLogIn should be checked before logging in a user.

This will prevent that locked out users can login in any form.

[bummzack]

Should I create a PR for this?

[colymba]

Yes please :) seems straightforward enough?

[bummzack]

PR is up #53