check account bans before allowing login