title: Locked out users can login if they have Auth Cookie
body: <p>.Net 4.5.1 / MVC 5.1.2 / Identity 2.0.1</p>
  
  <p>Greetings, </p>
  
  <p>I needed a way for administrators to disable (can't delete) user accounts so I set the LockoutEndDateUTC field to a future date and I already had the LockoutEnabled field set to true for all users.  There's another SO thread, <a href="https://stackoverflow.com/questions/22652118/disable-user-in-aspnet-identity-2-0" title="here">here</a>, that talks about the same method.  This obviously works but only if the user has to enter a username/password. </p>
  
  <p>Here's the problem... If the user has set the auth cookie with the "Remember Me" functionality prior to being disabled, the lockout is not being checked and all subsequent visits are authenticated and the "lockout" is ultimately overlooked.</p>
  
  <p>Firstly, I believe this to be a bug in Identity and I've already logged an issue on codeplex.  </p>
  
  <p>Second, Is there a better way to disable a user in version 2.0?</p>
  
  <p>Thank you!</p>