#2: [User] Deactivated user still can sign in