Refactor session handling for disabled accounts

Don't sign in the user until after their account_enabled status has been
verified.