VSSS-162 account expire should check last_login_at instead of last_activity_at