Make sure to respect the site owner's choice and not inadvertently create users.
Only try to set the auth cookie if we've found or created a user.