Which HTTP status code should I respond with after authenticating the user and then finding out that they have not activated their account after registration?