Problem: The message returned when authentication failed due to wrong username/password was the same as when user account was locked or had expired.
Solution: Added cases to if statement to add appropriate header messages in case of AccountExpiredException and LockedException