bugfix: a non-activated user could log in and sign up for an event