Add a comment explaining the PHP environment vars check
Remove now unused $group variable
Move up PHP env vars check
Disable login action in constructor

Allowing the login form does not make sense when one's checkPass() method can not
authenticate anyone else but the already successfully authenticated current user
(remember that authhttp is to be used together with external HTTP authentication).

We need a little hack with $conf['disabledactions'] because there is no capability
flag for 'login'.