do not allow inactive users to successfully login fixes #139