Disabling users doesn't affect active sessions

[msathieu]

If someone is already logged in, they can continue using zauth until they log out.

[rien]

You could add an extra check to UserSession whether the account of the user is not disabled: https://github.com/ZeusWPI/zauth/blob/main/src/ephemeral/session.rs#L118-L132

Note that this will only impact Zauth and not other services where the user used Zauth to login. There is no way to invalidate those active sessions.