isAuthenticated isn't enough, also check for active user in session