inactive users should never have any permissions

[stefanfoulis]

The default model backend from django.contrib.auth checks for this, but we dont.

Unfortunately all auth backends are iterated over and the permission is granted if one of them returns True. So even if we have both backends installed and the backend from django.contrib.auth returns False, the permission will still be granted for inactive users if they have permissions based on django-rulez.

[stefanfoulis]

I'm working on a pull request :-)

[chrisglass]

That's a bad bug - let me know if I can help!