users: deactivated users are also deactivated in LDAP

Currently deactivated user can still login via LDAP.

One potential solution is to "invalidate" LDAP user password after deactivation https://www.openldap.com/lists/openldap-technical/201111/msg00164.html