working on shiro integration

also password service, plus disabled user account flag.
Shiro integration now working, also added "status" (disabled/enabled) for ApplicationUser