OpenAM validates that the user exists, has an active account, and has set answers to her secret questions.