bug fix: non-actived users can login