only check for lockout if the user exists