Thinking about it, this would only allow for methods with `@CSRFExemption` unless we do something like:
```php
if($this->api->login(
    $this->request->server['PHP_AUTH_USER'],
    $this->request->server['PHP_AUTH_PW']
) {
    $this->request->server['HTTP_REQUESTTOKEN'] = \OC_Util::callRegister(); 
}
```
Which is both very ugly and breaks the concept of an immutable request object.