Fix suspended scope

:not_suspended should check if suspension is <= NOW, else one could end up in neither group.
That is, unless the scope is used to check if user was _never_ suspended.