Security just about hanging together, but not happy with the way an
inactive user is prompted.  This is misusing an exception which could be
thrown for other reasons.  Need to further refactor.  Perhaps the
following URL will be useful:

http://stackoverflow.com/questions/21655351/get-userid-on-controller-classes-when-hit-exceptionmappingauthenticationfailureh
Figured out the security issue... wasn't assigning the value of
Account.active to the new User object in UserService.  Spring
automatically generates the LockedException which the
ExceptionMappingAuthenticationFailureHandler deals with