Do tokens still work if user/application/group is not approved?

[rtisma]

if you search for the use of user.getStatus() and group.getStatus() and application.getStatus(), you will see that they are not used directly with authorizing a token. Some deeper investigation is needed into analyzing if spring security is doing this somehow.

Also, need to test this some how