Admins who haven't been approved can log in when must_approve_users is enabled