inactive user cannot access the api