Steps to reproduce the issue

1) Open the file /libraries/cms/application/cms.php
2) Search function login($credentials, $options = array())
3) Search lines (819 - 826):

            $authorisations = $authenticate->authorise($response, $options);

            foreach ($authorisations as $authorisation)
            {
                $denied_states = array(JAuthentication::STATUS_EXPIRED, JAuthentication::STATUS_DENIED);

                if (in_array($authorisation->status, $denied_states))
                {

Expected result

IMHO that will be better this way:

            $authorisations = $authenticate->authorise($response, $options);
            $denied_states = JAuthentication::STATUS_EXPIRED | JAuthentication::STATUS_DENIED;

            foreach ($authorisations as $authorisation)
            {
                if ((int) $authorisation->status & $denied_states)
                {

Actual result

System information (as much as possible)

Joomla! 3.6.2

Additional comments

1) Bitwise operations more effective than array(...) and in_array().
2) $denied_states = array(...) is inside of the cycle, but value of $denied_states is invariable, so will be better to move the initialisation of it before of the cycle.