forbid non active users, and adjust login path is a absolute url