HTTP Auth "Bleed Through" Fix

Basically, if we disable NConf auth, but allow Apache (or whatever) to do it, which will (generally) set the REMOTE_USER variable, trust that. Has been in use since April in a pretty big shop, in combination with an LDAP-based SSO regime.