WebSession: fix login without email activation

* Fixes an issues where users could login without verifying their email
  addresss. This would have the side effect that inveniogc would remove
  the account after X number of days, if users did not validate their
  email address.