feat(disable user) - prohibit login after user disabled