if that field if false - even if they have valid credentials, all requests for that account should return a 4XX response