inactive users can authenticate