I see your point, I didn't notice that the parent mentioned WrongPasswordException, when I implemented something similar previously it looked like this: User.a

I see your point, I didn't notice that the parent mentioned WrongPasswordException, when I implemented something similar previously it looked like this: User.authorize(username, password) -> Returns true if valid username/password -> Returns false if username/password do not match -> Raises AccountDisabled if username/password valid but account disabled The normal login failure case is not exceptional - but the others are.