block non-active users; update tests; support 'global permissions' through Spoke permissions