add `active` flag to `User`

- users won't be destroyed anymore. It'll be used an `active` flag
- Don't allow inactive users to login
- Added `User::Caching`
- annotate
minor enhances

- annotate
- N+1 queries
- login view error will be same as returned by server
client-side user's `active` flag