Deactivate users via API

## Explanation

If one set isActivated user property to true with API, it works. While, setting isActivated to false fails.

## Technical details

- Version of Flarum: 0.1.0.b7
- Apache2.4
- PHP version: 5.6
- Hosted environment: metal

## Code

When isActivated is set to true, user get activated while setting it to false fails to deactivated user.

$ch = curl_init($this->api_url . '/users/' . $flarum_user_id);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PATCH");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Authorization: Token ' . $this->session->token
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
'data' => [
'attributes' => [
"isActivated" => false
]
]
]));
$result = curl_exec($ch);

Start by reproducing the PATCH request to the /users/{id} API endpoint with isActivated set to false and inspect the response. Compare it with the successful true case, then trace the user activation update path; done means the API deactivates the user when the property is false.

Written by the indexing model from the issue text.