Bug fix: non-actived users can login + encode password on reset