api_user#authentications now returns only active authentications.