reject non members: no login, no password reset