API session login returns 400 bad request for expired / disabled user

Hello,
the API session login returns 400 bad request for expired / disabled user...
Thx

1. Why is that an issue?
2. What's the payload?

Hi,
It should return "Account has expired - SecurityException"
as in Disableable.java (last line):

throw new SecurityException(getClass().getSimpleName() + " has expired");

but it is returning
response status code: 400, "Bad request"
...
M

What about the second question?

my bad: response is:
response: User is disabled - SecurityException (Disableable:36 < LoginService:99 < *:80 < SessionResource:137 < ...)
response.statusCode: 400

so it is OK. (it is changed from previous version I think - this is why I thought it's an error)
Sorry