a listener to the post login events can still reject a login, so that a
user is not necessarily available at the time.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>