Fixed #17903 -- Inactive users shouldn't have any permissions.

See [#17903](https://code.djangoproject.com/ticket/17903).
this and the check in `get_group_permissions()` is redundant with the check in `_get_permissions`