Actually verify that the user is active in Okta before passing authentication