Fail optional API auth on bad email/password.

Fixes #89.

Right now, entering the wrong username/password when making an API search request will _always_ give a `200` response, even if the username and password are wrong. That makes it difficult for clients to check whether they're entering the correct username/password.

This new logic seems simple enough: if the user is entering a username/password, then check them; otherwise, don't.

I had to alter `api_login_required` because my test failed until I did. (The `return false unless` line seemed to go ahead, even though `Account.log_in` failed.) I'm not sure if there are any real-world repercussions to my change, but if there are any, they're probably good ones :).