Following the tutorials on the subject, a client can request an access token and also authenticate themselves by posting username and password data to /Token. This issues an access token.
However how do you intercept that to perform checks such as invalid access request checks and lockout checks. These features are available on the Membership provider but /Token seems to bypass them.
Is there a way to perform these checks before a token is issued? Or do we need to write our own Login routine and issue the tokens manually?
Thanks