redirect if user is not activated