Validate user account before setting cookie on /oauth2/callback