add logic :locked user cannot login