Adjusted handling of inactive user login

The return status for inactive users was being checked
too early in the process, so I moved it from just after
the handling of POST /v1/users/ to after getting the
response from GET /v1/users/