Remove security token if user was deleted, is disabled or locked to p…

…revent infinite redirect loops to the login path (fixes #1798).

src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

@@ -17,6 +17,7 @@
 use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
 use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\AccountStatusException;
 use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 use Symfony\Component\Security\Core\Exception\InsufficientAuthenticationException;
 use Symfony\Component\Security\Http\HttpUtils;
@@ -158,6 +159,11 @@ private function startAuthentication(Request $request, AuthenticationException $
 
         $this->setTargetPath($request);
 
+        if ($authException instanceof AccountStatusException) {
+            // remove the security token to prevent infinite redirect loops
+            $this->context->setToken(null);
+        }
+
         return $this->authenticationEntryPoint->start($request, $authException);
     }