### Body

When user is logged in with a valid session and deactivated, refreshing the browser/reusing the session leads to an infinite redirection loop (which is stopped quickly by browser detecting the situation).

## Steps to Produce:

Make sure you are using two different browsers.
In Browser A:

Login as the normal user.

In Browser B:
1. Login as admin.
2. Go to Security > List Users
3. Disable a user by unchecking this box:
![image](https://github.com/apache/airflow/assets/595491/0c1af0c2-2203-466f-8329-cf03aa138695)

4. Now in browser A, refresh the page.
You'll see a message like this:
![image](https://github.com/apache/airflow/assets/595491/5d9292c7-1364-46c0-8d26-5426a095112e)
In the server logs, you'll see that a lot of requests have been made to the server.
![image](https://github.com/apache/airflow/assets/595491/0599869a-a2bd-48a4-9f68-5789f24bfa16)

# Expected behaviour

There should be no infinite redirection, but the request for the inactive user should be rejected and the user should be redirected to the login page.


### Committer

- [X] I acknowledge that I am a maintainer/committer of the Apache Airflow project.
with conf_vars({("webserver", "session_backend"): "invalid_value_for_session_backend"}):
            return app.create_app(testing=True)
    expected_exc_regex = (
        "^Unrecognized session backend specified in web_server_session_backend: "
        r"'invalid_value_for_session_backend'\. Please set this to .+\.$"
    )
    with pytest.raises(AirflowConfigException, match=expected_exc_regex):
        poorly_configured_app_factory()
def test_session_id_rotates(app, user_client):
    old_session_cookie = get_session_cookie(user_client)
    assert old_session_cookie is not None
    resp = user_client.get("/logout/")
    assert resp.status_code == 302
    patch_path = "airflow.auth.managers.fab.security_manager.override.check_password_hash"
    with mock.patch(patch_path) as check_password_hash:
        check_password_hash.return_value = True
        resp = user_client.post("/login/", data={"username": "test_user", "password": "test_user"})
    assert resp.status_code == 302
    new_session_cookie = get_session_cookie(user_client)
    assert new_session_cookie is not None
    assert old_session_cookie.value != new_session_cookie.value
def test_check_active_user(app, user_client):
    user = app.appbuilder.sm.find_user(username="test_user")
    user.active = False
    resp = user_client.get("/home")
    assert resp.status_code == 302
    assert "/logout" in resp.headers.get("Location")