don't add any permission to user if the account is expired
inform the user if the account has expired