consider deleted flag for database user authentication