Authenticate returns true for API requests when login:false

Unauthenticated API requests should go through when login:false. As of now they don't because the last line in our 'authenticate' method returns nil for API requests. Therefore, only the web UI works.