public function getUser($authToken, $deviceToken = '')
    {
        $user = null;
        // 1. get user from firewall
        $this->security($this->fwName)->getToken()->setTokenString($authToken);

        try {
            $user = $this->security($this->fwName)->getUser();
        } catch (TokenException $e) {
            if ($e->getCode() === TokenException::TOKEN_EXPIRED) {
                throw new LoginException('The current auth session is no longer valid.', 7);
            }
        }

        if (!$user->isAuthenticated()) {
            throw new LoginException('User is not authenticated', 6);
        }

        // 2. extract username
        $this->username = $user->getUsername();

        // do the checks
        if ($this->isAccountBlocked($this->username)) {
            $this->security->firewall($this->fwName)->processLogout();
            throw new LoginException('User account is blocked.', 2);
        }
        if (!$this->isAccountActive($this->username)) {
            $this->security->firewall($this->fwName)->processLogout();
            throw new LoginException('User hasn\'t confirmed his account.', 4);
        }
        if ($this->config->get('ValidateDevice', false)) {
            // validate the device
            if (!$this->isDeviceSessionValid($deviceToken)) {
                $this->security->firewall($this->fwName)->processLogout();
                //todo: invalidate session in login meta
                throw new LoginException('The device session is no longer valid.', 8);
            }
        }

        // is session still valid
        if (!$this->isSessionValid($authToken)) {
            $this->security->firewall($this->fwName)->processLogout();
            throw new LoginException('The current auth session is no longer valid.', 7);
        }

        // return User
        return $user;
    }