The web app uses form-based login, and a login module is designed to authecticate a user.

When a user login, and then log out. I delete the user from the database. The user can still login. It seems that in this case, the login module is not called.

How to solve this problem?