only allow active users to get authenticated via fb-auth-backend