core: prevent interactive login with API user accounts