Session revoking issue for disabled user account

[Inndy]

When an account has been disabled, it's session should be revoked but it doesn't.

[rschiang]

This require some fiddling around Django session middleware in order to clear session history. Currently disable accounts are only checked during login.