fix: check the user's state when handling a request

[NinhDoan]

Hello @dkmstr ,

I recently performed a penetration test (pentest) on the system and discovered a bug in session management. Specifically, when a user is inactive, they can still make requests to the system if their session has not been destroyed.

To fix this bug, I added a user state check to the request middleware and handler. Please review and confirm that it works as expected.

[dkmstr]

This is a nice solution.
Previously, we always think that the setting of that kind of flag will be available "on next login", but in this case, this is a much better solution :)

Thank you very much, i proceed to merge ;-)

Regards, good work.

[dkmstr]

I'll also add this to 3.6 release

[dkmstr]

Mmmm, it was a 3.6 patch :). Didnt work against.
Also, i have noticed this:
# self._user = User() # Empty user for non authenticated handlers
raise AccessDenied()

And this cannot be, because some REST apis are PUBLIC, without users or authentication.

It should be like this:
self._user = User() # Empty user for non authenticated handlers
self._user.state = types.states.State.ACTIVE # Ensure it's active

Dont worry, i'll fix these issues, again, thanks for your work! ;-)