What runs activate_user() in Flask-Security

Question

I took a look into the code of Flask-Security and can't figure out what runs datastore.activate_user() so the current_user.is_active returns True ?

from flask.ext.security.utils import login_user

class LoginView(BaseView):
    methods = ['GET', 'POST']

    def dispatch_request(self):
        form = CustomLoginForm()
        if form.validate_on_submit():
            login_user(form.user, remember=True)
            flash("Logged in successfully.")
            return redirect(request.args.get('next') or url_for('main'))
        return render_template("login.html", form=form, **self.content)

I use custom LoginForm. The form is validated, but login_user returns False.

excerpt from main manage.py:

app = create_app()
manager = Manager(app)

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, models.User, models.Role)
security = Security(app, user_datastore)

Here are the models.py

roles_users = db.Table(
    'roles_users',
    db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
    db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))


class Role(RoleMixin, db.Model):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True, info={'verbose_name': 'Role name'})
    description = db.Column(db.String(255))

    def __repr__(self):
        return '<Role %r>' % (self.name)


class User(UserMixin, db.Model):
    id = Column(Integer, primary_key=True)
    name = Column(String(128), info={'verbose_name': 'User name', })
    password = Column(String(64))
    company = Column(String(64))
    location = Column(String(64))
    email = Column(String(64))
    active = Column(Boolean)
    roles = db.relationship('Role', secondary=roles_users, backref=db.backref('users', lazy='dynamic'))

    last_login_at = Column(DateTime)
    current_login_at = Column(DateTime)
    last_login_ip = Column(String(64))
    current_login_ip = Column(String(64))
    login_count = Column(Integer)

    def __repr__(self):
        return '<User %r>' % (self.name)

Should run datastore.activate_user() myself when accepting the form ??