FIX: deactivated users shouldn't be able to log in