unauthorize sets another user active if possible