don't allow requests for disabled users

The previous behavior makes no sense because disabled users can't login even
if they have a password.