Figured it out, I needed two restricts, one for login ID being available, and one for activation being set to true. Then the accept if clearance was high enough for the zone they were requesting.
I am using a case switch to send different access levels to different areas of the website, this is on the login page - it was creating an endless loop when the user wasn't activated. I added another if statement before the case statement to redirect the user only if they were activated, and if they weren't then they get routed to the activation reminder page.
If there is more efficient way of doing all of this (and I suspect that there may be) then I would love to hear what it is. ;)