1. Check authentication only if the user is enabled.