Fixed #17903 -- Inactive users shouldn't have any permissions.

See [#17903](https://code.djangoproject.com/ticket/17903).
Updated with your corrections.

Moreover, last assert was wrong:

```python
# and `get_user_permissions`.
self.assertEqual('auth.test' in user.get_group_permissions(), False)  # get_group_permissions???
```
and cannot be tested since `get_user_permissions` is not defined (nor used) in the default user model. I removed that assert for now; any suggestions on how to test it?