Expired users can still perform actions

There is an expires field for users, but nothing is ever done with it.