Fixed #17903 -- Inactive users shouldn't have any permissions.

This is on the authentication backend level.

Thanks to:
- @SmileyChris for the report.
- @timgraham for the review.