disable expired users before calling authenticate, fixes #8