fix xmlrpc usage by doing external auth only for do=login