updated UserRepository to check if user is enabled and not locked