Issue title: ORM Auth _login ussing login blocked message
 Issue body: class Kohana_Auth_ORM

if ($user->has('roles', ORM38d1:d2b4:3d06:83e8:96a5:8c2:893d:aba5tory('Role', array('name' => 'login'))) AND $user->password === $password) line: 90
When user try to login Auth ORM check password and role in one line so even username and password is correct but login role is remove system can't tell user that that login privilege is remove and they need to contact admin. 
 Comments: 
 Comment 0: Well, if login role has been removed you wouldn't be able to log in. But there shouldn't be message "Our admin has messed up the settings, so you can't log in. "

You could make login,admin roles non-removable in your system.
Therefore it is not a bug.
 Comment 1: What if Admin deliberately block user access by removing login role? 
 Comment 2: How is that a software issue?
 Comment 3: What do you think what issue it is? user entering correct username and password but getting a standard message "wrong username or password", In this case they think password is wrong and attempt to reset password. but in reality Admin has blocked them from website by removing login role. Its functional requirement of Login function. it need to return distinct message why login failed.    
 Comment 4: Can you suggest a PR?
 Comment 5: after a long though I conclusion is not to change login function. as it will be tricky to change function return type.. 
current return type bool can only support logged in or not.. so we need some kind of message system or complex return type..
So I have updated my password reset function. if user account is blocked or not active. it show message that user can't request password reset as account is blocked and they need to contact Admin for help. 



 Comment 6: In fact, it's not entirely correct to block users in this way. You must add a new role, or a mark for blocked users. After authorization, it is necessary to check whether the user is blocked and restrict his actions, if necessary.
 Comment 7: Yes there are many ways to approach this issue. Here is what happening to my sites.
Users signup they get login role assigned.. 

But some time in future admin remove the login role so user was unable to login.. system worked as it was suppose to work.. but user was confused how they can't login even after resetting password many times.. 

Once even one admin uncheck the login role from other admin .. so I have done two changes 

1. Updated the user edit code so there is always at least on user with Admin and login role 
2.  on password reset screen tell user if their account is blocked or not. 
{'source': 'GithubIssues', 'repo_name_with_owner': 'koseven/koseven', 'issue_id': 256999278, 'repo_stars': 384.0}