prevent disabled user using API