mark new users from oauth2 as inactive
remember where you were
this was noisy
require authentication for all results