Adds optional metadata check on login

Some spam bots are using predictable values for some profile manager fields, this allows us to check custom metadata fields for a banned string using a 'contains' type of check, and prevents login if there's a match.