Verifying a new user account does not unlock that account.

### Steps to Reproduce

I've created a demo grails app that uses spring-security-ui and contains a failing integration test that I would expect to pass.

$ grails test-app

### Expected Behaviour

The test creates a User object with a registration token. That User object has the accountLocked field set to true (which corresponds to the state of that field when a new user account is created through the browser).

I would expect that when the user clicks on the verification link that they receive by email (/registration/verifyRegistration?t=xxxxxxxxxxx) that the accountLocked field would be set to false.

### Actual Behaviour

The user is logged in, but their account is still locked, so that future login attempts will fail.

### Environment Information

I'm on Windows 10, but I've also tried it on Ubuntu 16.04

$ grails --version
|Grails Version: 3.3.8
|Groovy Version: 2.4.15
|JVM Version: 1.8.0_161

### Example Application

https://github.com/spierepf/demo